How do you derive the lambda and beta values for endomorphism on the secp256k1 curve? Note: This question was reposted from Bitcoin Stack Exchange, where it received alike answers.



You can see a little background about this on this bitcointalk post by the late Hal Finney.

$\beta$ and $\lambda$ are the values on the secp256k1 curve such that:
$$\begin{align}
\lambda^3 &amp;= 1 \mod N \\
\beta^3 &amp;= 1 \mod P \\
\end{align}$$

As seen here, in hex, $N$ and $P$ are:
$$\begin{align}
N &amp;= \mathtt{FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFE\ BAAEDCE6\ AF48A03B\ BFD25E8C\ D0364141} \\
P &amp;= \mathtt{FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFF\ FFFFFFFE\ FFFFFC2F} \\
\end{align}$$

The actual values of lambda and beta are easily verifiable and are:
$$\begin{align}
\lambda &amp;= \mathtt{5363ad4c\ c05c30e0\ a5261c02\ 8812645a\ 122e22ea\ 20816678\ df02967c\ 1b23bd72} \\
\beta &amp;= \mathtt{7ae96a2b\ 657c0710\ 6e64479e\ ac3434e9\ 9cf04975\ 12f58995\ c1396c28\ 719501ee} \\
\end{align}$$

The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?
Given that $N$ and $P$ are prime, one obvious way to do this is to select a random value $g$ from $[1, N-1]$, and compute $g^{(N-1)/3} \bmod N$; assuming that $N \equiv 1 \pmod{3}$, this resulting value will either be 1, the displayed value of $\lambda$, or $N-\lambda-1$ (with equal probabilities of each).  If $N \not\equiv 1 \pmod{3}$, then the only modular cube root of 1 will be 1.

And, to compute $\beta$, you do the same with $P$.