Question: 1. Suppose Alice and Bob have specified an elliptic curve, for example, secp256k1. Alice has a secret number $s$ (can be seen as secret key), Bob choose a point $g$ on the curve and send it to Alice. After receiving the point, Alice computes $g^s$ and sends it the Bob.
$\text{Whether the interaction will reveal Alice's secret key?}$
2. Similarly, in a RLWE system, Alice has a secret polynomial $s\in R\_q$ ($R\_q=\mathbb{Z}\_q[x]/(x^n+1)$),Bob chooses a polynomial $a\in R\_q$ and sends it to Alice, Alice compute $as+e$, where $e\leftarrow \chi$ is a secure distribution in RLWE, then in this situation, whether Bob will learn the secret $s$? Intuitively, if Bob chooses some polynomial $a$ satisfied $ab=0$ for some $b$, then it seems that Bob could learn the $s$, but does Alice have some methods to judge if the polynomial $a$ come from Bob has the property?

Answer: 
For the second question, it depends on whether we can trust Bob to generate $a$ uniformly at random and without any “hidden structure.” If we can trust him, then this is secure assuming RLWE is hard; what Bob gets is merely one properly distributed RLWE sample.

However, if Bob may choose $a$ in a malicious or “sneaky” way, then there can be attacks. For example, Bob can choose $a$ as an NTRU public key, as $a=f \cdot g^{-1} \pmod{q}$ for “short” polynomials $f,g$ of a certain form that constitute the secret key. Then, giving Bob $s \cdot a + e$ for short $s,e$ is essentially just NTRU encryption, and Bob can use $f,g$ to recover $s,e$. Moreover, such an $a$ doesn’t even seem to “look suspicious,” since it’s commonly conjectured that NTRU keys constructed in this way are indistinguishable from uniformly random. So Alice can’t even hope to catch Bob being sneaky in this way.

If Bob doesn’t care about “acting suspiciously,” then there is an even simpler attack: Bob can choose $a=p$ for some small scalar integer $p$ that will be slightly bigger than the coefficients of $e$. Then, giving Bob $b =s \cdot a + e = ps + e$ makes it easy for Bob to recover $e$ (just reduce $b$ modulo $p$) and then $s$.
Correction to kelalaka's answer:

> 
> Bob chooses a polynomial $a\in R\_q$ and sends it to Alice, Alice compute $as+e$, where $e\leftarrow \chi$ is a secure distribution in RLWE, then in this situation, whether Bob will learn the secret $s$?
> 
> 
> 

If Bob is limited to a single interaction, then no, Bob cannot recover $s$ (with the RLWE assumption, of course). However, if Bob is allowed to perform a number of exchanges (with Alice using the same $s$), then yes, he can.

Bob can probe $s$; he can submit $a$ and $a+\Delta$ (where $\Delta$ is the vector with the value $\delta$ in the first position, and zeros elsewhere); and get the two answers $as + e$ and $(a+\Delta)s + e'$; subtracting them gives $\Delta s + (e - e') = \delta s + (e - e')$, that is, the secret array $s$ multiplied by a known scalar, and a (slightly larger) error vector. By performing this several times (with different $\delta$ values), we can recover the exact value of $s$.