After asking: Are all possible EC private keys valid? I learned that all 32 byte (256 bit) values greater than 0 and less than n are all valid private keys. This means that 99% of all 256 bit values are valid private keys. (This was a revelation to me.)
The public key space is 257 bits, as it includes X and the sign bit of Y.
Is there an exact 1:1 mapping between private and public keys?
Is there a way of telling whether a 257 bit value is a valid public key? (i.e. that a private key maps to it, as slightly more than half of all 257 bit values must not be valid public keys, if there is a 1:1 mapping.)
(I'm using secp256k1.)
Thanks for your answers.
My mental model, for an imaginary curve with n = 5, a 3 bit private key and 4 bit public key now looks like this:
private public 0x0 +-----------> 0x0 0x1 ---+ 0x1 0x2 -----------+ 0x2 0x3 ---------+ | 0x3 0x4 ---+ +-|---> 0x4 0x5 | | 0x5 0x6 | | 0x6 0x7 | | 0x7 | | 0x8 | +---> 0x9 | 0xa | 0xb | 0xc | 0xd | 0xe +-----------> 0xf