<p>Quoting <a href="https://crypto.stackexchange.com/a/22739/12164">cryptography.stackexchange.com</a>:</p>
<blockquote>
<p>Given that N and P are prime, one obvious way to do this is to select a random value g from [1,N−1], and compute g^((N−1)/3) mod N; assuming that N≡1(mod 3), this resulting value will either be 1, the displayed value of λ, or N−λ−1 (with equal probabilities of each). If N≢1(mod 3), then the only modular cube root of 1 will be 1.</p>
<p>And, to compute β, you do the same with P.</p>
</blockquote>
<hr />
<p>The reason this works is due to Fermat's little theorem which states:</p>
<p>g^(N-1) ≡ 1 (mod N)</p>
<p>which implies</p>
<p>(g^((N-1)/3))^3 ≡ 1 (mod N)</p>
<p>which implies</p>
<p>g^((N-1)/3) is our potential λ. If it's not 1, it'll work for the purposes of endomorphism.</p>

CC BY-SA 3.0
2015-02-03T04:56:13.753Z
I'm in the middle of writing the same thing up, basically, but with some more concrete numbers. :/
morsecoder
CC BY-SA 3.0
2015-02-03T04:55:07.813Z
2015-10-29T18:02:52.807Z
2020-06-16T11:10:03.350Z
Jimmy Song
<p>Python code to get beta and lambda values for <strong>p</strong> and <strong>n</strong> of secp256k1 curve</p>
<p><strong>Getting beta of p</strong></p>
<pre><code>p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
print &quot;beta of p = 0x%x&quot; % pow(2, (p-1)/3, p)
</code></pre>
<blockquote>
<p>beta of p = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee</p>
</blockquote>
<p><strong>Getting lambda of n</strong></p>
<pre><code>n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
print &quot;lambda of n = 0x%x&quot; % pow(3, (n-1)/3 , n)
</code></pre>
<blockquote>
<p>lambda of n = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72</p>
</blockquote>
<hr />
<p><strong>More info</strong></p>
<p>I experimented further with this by getting beta and lambda for both <strong>p</strong> and <strong>n</strong> and discovered that all the results generated become useful for finding the identical values for <strong>x</strong> or <strong>y</strong> in the equation y ^ 2 = x ^ 3 + 7 mod p</p>
<pre><code>#beta and lambda for p
p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
betaOfP = pow(2, (p-1)/3, p)
lambdaOfP = pow(3, (p-1)/3, p)
print &quot;betaOfP \t= 0x%x &quot; % betaOfP 
print &quot;lambdaOfP\t= 0x%x &quot; % lambdaOfP 
print

#beta and lambda for n
n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
betaOfN = pow(2, (n-1)/3 , n)
lambdaOfN = pow(3, (n-1)/3 , n)
print &quot;betaOfN \t= 0x%x&quot; % betaOfN
print &quot;lambdaOfN\t= 0x%x&quot; % lambdaOfN
</code></pre>
<blockquote>
<p>betaOfP         = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee
lambdaOfP       = 0x851695d49a83f8ef919bb86153cbcb16630fb68aed0a766a3ec693d68e6afa40</p>
<p>betaOfN         = 0xac9c52b33fa3cf1f5ad9e3fd77ed9ba4a880b9fc8ec739c2e0cfc810b51283ce
lambdaOfN       = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72</p>
</blockquote>

CC BY-SA 3.0
2015-10-28T11:04:22.263Z
2015-10-29T08:11:46.440Z
2020-06-16T11:10:03.350Z
Sean Bradley
<p>With a bit of reverse engineering, I think I was able to see how Hal was able to get to these results. </p>

<p>First, it's a pretty well known result of Fermat's little theorem that if <code>p</code> is a prime number and <code>g</code> is a generator for the field <code>Z/pZ</code>, then:</p>

<pre><code>g ^ (p - 1) = 1
</code></pre>

<p>Note, don't confuse this abstract generator <code>g</code> with the generator for the secp256k1 group <code>G</code>. Now, given the above equation, it's not a big leap to see that:</p>

<pre><code>(g ^ ((p - 1)/3)^3 = g ^ (p - 1) = 1
</code></pre>

<p>Thus, we can find <code>λ</code> and <code>β</code> by first finding generators for <code>Z/NZ</code> and <code>Z/PZ</code> (<code>N</code> and <code>P</code> being the parameters given in the original question), and then raising them to the <code>(N-1)/3</code> and <code>(P-1)/3</code> powers, respectively. You can check that both <code>N-1</code> and <code>P-1</code> are divisible by 3. </p>

<p>The generator that it seems Hal used for <code>λ</code> is 3, and for <code>β</code> is 2. I'm not sure why he picked those, there are plenty of other good generators to choose from. It was probably on a trial and error basis.</p>

<p>Using sage mathematics notebook, I was able to produce the same values for <code>λ</code> and <code>β</code>. </p>

<p><img src="https://i.sstatic.net/35XYp.png" alt="enter image description here"></p>

CC BY-SA 4.0
2022-08-18T02:14:39.590Z
lambda and beta are non-trivial cube roots of 1 in the respective fields (mod n for lambda, mod p for beta). There are only two such values. Starting from a generator g and raising to the power (n-1)/3 resp. (p-1)/3 to find them is just one way of doing so. And it doesn't matter which g one starts with, one always finds one of the two valid solutions, or 1 (if the g started from wasn't a generator, but a cube).
Pieter Wuille
CC BY-SA 3.0
2015-02-03T05:03:45.027Z
2015-02-03T05:17:19.797Z
2015-02-03T05:17:19.797Z
morsecoder
<p>You can see a little background about this on this <a href="https://bitcointalk.org/index.php?topic=3238.0" rel="nofollow noreferrer">bitcointalk post</a> by the late Hal Finney.</p>

<p>Beta and lambda are the values on the secp256k1 curve where:</p>

<p>λ^3 (mod N) = 1</p>

<p>β^3 (mod P) = 1</p>

<p>As seen <a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow noreferrer">here</a>, in hex, N and P are:</p>

<p>N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141</p>

<p>P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F</p>

<p>The actual values of lambda and beta are easily verifiable and are:</p>

<p>λ = 5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72</p>

<p>β = 7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee</p>

<p>The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?</p>

<p><em><a href="https://crypto.stackexchange.com/questions/22738/how-do-you-derive-the-lambda-and-beta-values-for-endomorphism-on-the-secp256k1-c">Also posted to the Cryptography Stack Exchange</a></em></p>

CC BY-SA 3.0
2015-02-02T07:03:01.000Z
You might be more likely to get an answer on the cryptography SE site.
Tyler
CC BY-SA 3.0
2015-02-02T23:55:39.823Z
Hal Finney says he found hints about how to compute it in pages 125-129 of the *Guide to Elliptic Curve Cryptography*, by Hankerson, Menezes and Vanstone. He found a PDF on a Russian website.
David Grayson
CC BY-SA 3.0
2015-02-02T23:57:45.740Z
I've actually read that book and those particular pages multiple times and couldn't figure it out.
Jimmy Song
<cryptography><ecdsa><secp256k1>
How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?
Jimmy Song
# How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

(Asked by: username_0 on 2015-01-30)

You can see a little background about this on this [bitcointalk post](https://bitcointalk.org/index.php?topic=3238.0) by the late Hal Finney.

Beta and lambda are the values on the secp256k1 curve where:

λ^3 (mod N) = 1

β^3 (mod P) = 1

As seen [here](https://en.bitcoin.it/wiki/Secp256k1), in hex, N and P are:

N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141

P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

The actual values of lambda and beta are easily verifiable and are:

λ = 5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72

β = 7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee

The question for me is, how do you derive this? Can someone show me step-by-step how you can figure out these values?

*[Also posted to the Cryptography Stack Exchange](https://crypto.stackexchange.com/questions/22738/how-do-you-derive-the-lambda-and-beta-values-for-endomorphism-on-the-secp256k1-c)*

**Tags:** cryptography, ecdsa, secp256k1

> **Comments:**
> **username_1**: You might be more likely to get an answer on the cryptography SE site.  
> **username_2**: Hal Finney says he found hints about how to compute it in pages 125-129 of the *Guide to Elliptic Curve Cryptography*, by Hankerson, Menezes and Vanstone. He found a PDF on a Russian website.  
> **username_0**: I've actually read that book and those particular pages multiple times and couldn't figure it out.  

---

## 3 answers

### Answer by username_3 on 2015-02-03. Score: 4 | Accepted answer

With a bit of reverse engineering, I think I was able to see how Hal was able to get to these results. 
First, it's a pretty well known result of Fermat's little theorem that if p is a prime number and g is a generator for the field Z/pZ, then:
g ^ (p - 1) = 1

Note, don't confuse this abstract generator g with the generator for the secp256k1 group G. Now, given the above equation, it's not a big leap to see that:
(g ^ ((p - 1)/3)^3 = g ^ (p - 1) = 1

Thus, we can find λ and β by first finding generators for Z/NZ and Z/PZ (N and P being the parameters given in the original question), and then raising them to the (N-1)/3 and (P-1)/3 powers, respectively. You can check that both N-1 and P-1 are divisible by 3. 
The generator that it seems Hal used for λ is 3, and for β is 2. I'm not sure why he picked those, there are plenty of other good generators to choose from. It was probably on a trial and error basis.
Using sage mathematics notebook, I was able to produce the same values for λ and β.

> **Comments:**
> **username_5**: lambda and beta are non-trivial cube roots of 1 in the respective fields (mod n for lambda, mod p for beta). There are only two such values. Starting from a generator g and raising to the power (n-1)/3 resp. (p-1)/3 to find them is just one way of doing so. And it doesn't matter which g one starts with, one always finds one of the two valid solutions, or 1 (if the g started from wasn't a generator, but a cube).  

---

### Answer by username_0 on 2015-02-03. Score: 2

Quoting [cryptography.stackexchange.com](https://crypto.stackexchange.com/a/22739/12164):

> Given that N and P are prime, one obvious way to do this is to select a random value g from [1,N−1], and compute g^((N−1)/3) mod N; assuming that N≡1(mod 3), this resulting value will either be 1, the displayed value of λ, or N−λ−1 (with equal probabilities of each). If N≢1(mod 3), then the only modular cube root of 1 will be 1.
>
> And, to compute β, you do the same with P.

---

The reason this works is due to Fermat's little theorem which states:

g^(N-1) ≡ 1 (mod N)

which implies

(g^((N-1)/3))^3 ≡ 1 (mod N)

which implies

g^((N-1)/3) is our potential λ. If it's not 1, it'll work for the purposes of endomorphism.

> **Comments:**
> **username_3**: I'm in the middle of writing the same thing up, basically, but with some more concrete numbers. :/  

---

### Answer by username_4 on 2015-10-28. Score: 0

Python code to get beta and lambda values for p and n of secp256k1 curve
Getting beta of p
p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
print "beta of p = 0x%x" % pow(2, (p-1)/3, p)


beta of p = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee

Getting lambda of n
n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
print "lambda of n = 0x%x" % pow(3, (n-1)/3 , n)


lambda of n = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72


More info
I experimented further with this by getting beta and lambda for both p and n and discovered that all the results generated become useful for finding the identical values for x or y in the equation y ^ 2 = x ^ 3 + 7 mod p
#beta and lambda for p
p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
betaOfP = pow(2, (p-1)/3, p)
lambdaOfP = pow(3, (p-1)/3, p)
print "betaOfP \t= 0x%x " % betaOfP 
print "lambdaOfP\t= 0x%x " % lambdaOfP 
print

#beta and lambda for n
n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
betaOfN = pow(2, (n-1)/3 , n)
lambdaOfN = pow(3, (n-1)/3 , n)
print "betaOfN \t= 0x%x" % betaOfN
print "lambdaOfN\t= 0x%x" % lambdaOfN


betaOfP         = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee
lambdaOfP       = 0x851695d49a83f8ef919bb86153cbcb16630fb68aed0a766a3ec693d68e6afa40
betaOfN         = 0xac9c52b33fa3cf1f5ad9e3fd77ed9ba4a880b9fc8ec739c2e0cfc810b51283ce
lambdaOfN       = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72


---

