user23123: You can see a little background about this on this bitcointalk post by the late Hal Finney.
Beta and lambda are the values on the secp256k1 curve where:
λ^3 (mod N) = 1
β^3 (mod P) = 1
As seen here, in hex, N and P are:
N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141
P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
The actual values of lambda and beta are easily verifiable and are:
λ = 5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72
β = 7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee
The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?
Also posted to the Cryptography Stack Exchange

user23123: Quoting cryptography.stackexchange.com:

Given that N and P are prime, one obvious way to do this is to select a random value g from [1,N−1], and compute g^((N−1)/3) mod N; assuming that N≡1(mod 3), this resulting value will either be 1, the displayed value of λ, or N−λ−1 (with equal probabilities of each). If N≢1(mod 3), then the only modular cube root of 1 will be 1.
And, to compute β, you do the same with P.


The reason this works is due to Fermat's little theorem which states:
g^(N-1) ≡ 1 (mod N)
which implies
(g^((N-1)/3))^3 ≡ 1 (mod N)
which implies
g^((N-1)/3) is our potential λ. If it's not 1, it'll work for the purposes of endomorphism.

user18196: With a bit of reverse engineering, I think I was able to see how Hal was able to get to these results. 
First, it's a pretty well known result of Fermat's little theorem that if p is a prime number and g is a generator for the field Z/pZ, then:
g ^ (p - 1) = 1

Note, don't confuse this abstract generator g with the generator for the secp256k1 group G. Now, given the above equation, it's not a big leap to see that:
(g ^ ((p - 1)/3)^3 = g ^ (p - 1) = 1

Thus, we can find λ and β by first finding generators for Z/NZ and Z/PZ (N and P being the parameters given in the original question), and then raising them to the (N-1)/3 and (P-1)/3 powers, respectively. You can check that both N-1 and P-1 are divisible by 3. 
The generator that it seems Hal used for λ is 3, and for β is 2. I'm not sure why he picked those, there are plenty of other good generators to choose from. It was probably on a trial and error basis.
Using sage mathematics notebook, I was able to produce the same values for λ and β. 


23123: <p>You can see a little background about this on this <a href="https://bitcointalk.org/index.php?topic=3238.0" rel="nofollow noreferrer">bitcointalk post</a> by the late Hal Finney.</p>

<p>Beta and lambda are the values on the secp256k1 curve where:</p>

<p>λ^3 (mod N) = 1</p>

<p>β^3 (mod P) = 1</p>

<p>As seen <a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow noreferrer">here</a>, in hex, N and P are:</p>

<p>N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141</p>

<p>P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F</p>

<p>The actual values of lambda and beta are easily verifiable and are:</p>

<p>λ = 5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72</p>

<p>β = 7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee</p>

<p>The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?</p>

<p><em><a href="https://crypto.stackexchange.com/questions/22738/how-do-you-derive-the-lambda-and-beta-values-for-endomorphism-on-the-secp256k1-c">Also posted to the Cryptography Stack Exchange</a></em></p>
 23123: <p>Quoting <a href="https://crypto.stackexchange.com/a/22739/12164">cryptography.stackexchange.com</a>:</p>
<blockquote>
<p>Given that N and P are prime, one obvious way to do this is to select a random value g from [1,N−1], and compute g^((N−1)/3) mod N; assuming that N≡1(mod 3), this resulting value will either be 1, the displayed value of λ, or N−λ−1 (with equal probabilities of each). If N≢1(mod 3), then the only modular cube root of 1 will be 1.</p>
<p>And, to compute β, you do the same with P.</p>
</blockquote>
<hr />
<p>The reason this works is due to Fermat's little theorem which states:</p>
<p>g^(N-1) ≡ 1 (mod N)</p>
<p>which implies</p>
<p>(g^((N-1)/3))^3 ≡ 1 (mod N)</p>
<p>which implies</p>
<p>g^((N-1)/3) is our potential λ. If it's not 1, it'll work for the purposes of endomorphism.</p>
 18196: <p>With a bit of reverse engineering, I think I was able to see how Hal was able to get to these results. </p>

<p>First, it's a pretty well known result of Fermat's little theorem that if <code>p</code> is a prime number and <code>g</code> is a generator for the field <code>Z/pZ</code>, then:</p>

<pre><code>g ^ (p - 1) = 1
</code></pre>

<p>Note, don't confuse this abstract generator <code>g</code> with the generator for the secp256k1 group <code>G</code>. Now, given the above equation, it's not a big leap to see that:</p>

<pre><code>(g ^ ((p - 1)/3)^3 = g ^ (p - 1) = 1
</code></pre>

<p>Thus, we can find <code>λ</code> and <code>β</code> by first finding generators for <code>Z/NZ</code> and <code>Z/PZ</code> (<code>N</code> and <code>P</code> being the parameters given in the original question), and then raising them to the <code>(N-1)/3</code> and <code>(P-1)/3</code> powers, respectively. You can check that both <code>N-1</code> and <code>P-1</code> are divisible by 3. </p>

<p>The generator that it seems Hal used for <code>λ</code> is 3, and for <code>β</code> is 2. I'm not sure why he picked those, there are plenty of other good generators to choose from. It was probably on a trial and error basis.</p>

<p>Using sage mathematics notebook, I was able to produce the same values for <code>λ</code> and <code>β</code>. </p>

<p><img src="https://i.stack.imgur.com/35XYp.png" alt="enter image description here"></p>
