Let's say we're using the Ed25519 curve, and we're computing a Diffie-Hellman shared secret EC point $S$ by scalar multiplication of scalar $a$ with EC point $B$.
Is there any way of partially calculating at least a few bits of $S$ without completing the full scalar multiplication process?
The goal is to be able to communicate a few bits (ideally 8 bits) of $S$ in advance to the person that intends to compute $S = a\cdot B$. The recipient will perform a quick partial calculation first to check if a full calculation will actually result in a value of $S$ that will have the specified 8 bits.
The sender of the 8 bits will not know $a$, because instead they will know $A$ and $b$ such that $bA==aB$.
If certain bits cannot be partially computed, can any characteristics of $S$ be partially computed instead?
Even 1 bit of information about $S$ through partial calculation would be useful.
