# With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$?

(I understand that $k$ should be random, or follow RFC6979, but I'm curious.)

In particular, could the verifier compute, given a signature $(r,s)$ and a message $m$, that:

1. $k$ is odd
2. $k$ has some mathematical relation to one of the curve parameters
3. $k$ has some mathematical relation to the public key $Q_A$
4. $k$ has some mathematical relation to the (truncated) message hash $z$
5. $k$ was deterministically generated with RFC6979 https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#cite_note-4

for the value of $k$ which was used to generate the signature.

(Variable names taken from https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm)

• By $K$, do you mean $k$ (as in the article)? – fkraiem Nov 5 '15 at 10:44
• Also, to whom should this be proven? By itself, the statement "$k$ is odd" is meaningless since $k$ is not defined. However, given a signature $(r,s)$ and a message $m$, the statement "the value of $k$ which was used to generate this signature is odd" may be meaningful, assuming there is only one possible $k$, or all the possible $k$s have the same parity. – fkraiem Nov 5 '15 at 10:56
• Yes, I've corrected my question. How did you write the pretty-k in your comment? – Thomas Von Panom Nov 5 '15 at 10:56
• See this help page on Math.SE about TeX formatting. – fkraiem Nov 5 '15 at 10:59
• I think you may be using the word "to prove" in a different way than it is normally used in cryptography. Do you actually mean "it is possible to compute/obtain the parity of $k$ from $(r,s)$ and $m$"? – fkraiem Nov 5 '15 at 11:18

There are no relation we are currently aware of. The reason is as follows. The map $$k \mapsto (k G).x$$ is assumed to be a good pseudo random number generator.