# With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $$(r,s)$$ and $$m$$, is there a way for a verifier to calculate any (boolean) properties of $$k$$, without knowing $$k$$ or the private key $$D_A$$?

(I understand that $$k$$ should be random, or follow RFC6979, but I'm curious.)

In particular, could the verifier compute, given a signature $$(r,s)$$ and a message $$m$$, that:

1. $$k$$ is odd
2. $$k$$ has some mathematical relation to one of the curve parameters
3. $$k$$ has some mathematical relation to the public key $$Q_A$$
4. $$k$$ has some mathematical relation to the (truncated) message hash $$z$$
5. $$k$$ was deterministically generated with RFC6979. See the article Android Security Vulnerability for the value of $$k$$ which was used to generate the signature.

(Variable names were taken from here.)

• By $K$, do you mean $k$ (as in the article)? Nov 5, 2015 at 10:44
• Also, to whom should this be proven? By itself, the statement "$k$ is odd" is meaningless since $k$ is not defined. However, given a signature $(r,s)$ and a message $m$, the statement "the value of $k$ which was used to generate this signature is odd" may be meaningful, assuming there is only one possible $k$, or all the possible $k$s have the same parity. Nov 5, 2015 at 10:56
• Yes, I've corrected my question. How did you write the pretty-k in your comment? Nov 5, 2015 at 10:56
• See this help page on Math.SE about TeX formatting. Nov 5, 2015 at 10:59
• I think you may be using the word "to prove" in a different way than it is normally used in cryptography. Do you actually mean "it is possible to compute/obtain the parity of $k$ from $(r,s)$ and $m$"? Nov 5, 2015 at 11:18

There are no relation we are currently aware of. The reason is as follows. The map $$k \mapsto (k G).x$$ is assumed to be a good pseudo random number generator.