Public-private algorithm where it is not possible to recover public key from private key? Is there an asymmetric algorithm where it is not possible to extract a public key from private key? So far any algorithms I tried (dsa, rsa, ecdsa, ed25519) successfully recover their public keys from private ones with 'ssh-keygen -y -f private.key'.
RSA as initialy described (R.L. Rivest, A. Shamir, and L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, in CACM, 1978) has this property that it is impossible to find the public key $(N,e)$ from the private key expressed as $(N,d)$. For modern parameters, pick random primes $p$ and $q$ in range $[2^{2047.5},2^{2048}]$, pick random $4095$-bit $d$ with $\gcd(p-1,d)=1=\gcd(q-1,d)$, compute $N=p\,q$ and $e=d^{-1}\bmod((p-1)(q-1))$, keep the private key $(N,d)$ and separately the public key $(N,e)$, but destroy $p$, $q$, and $(p-1)(q-1)$.

Note: While that original RSA system does not allow "to extract a public key from private key", it is still possible to test if public and private key match; that seems unavoidable for any public-key cryptosystem, be it for encryption or signature.

Modern RSA has $e$ (and often $p$ and $q$) in the private key, because


it is generally a feature that the public key can be extracted from the private key
having $p$ and $q$ allows to speed up private-key operation considerably
having $e$ allows to verify computations made with the private key, which is useful to guard against some attacks.


Also, modern RSA typically uses small $e$ (often $2^{(2^k)}+1$ for $0\le k\le4$) and that makes guessing $e$ and verifying the guess trivial.