Paul Miller's explanation of endomorphism:
secp256k1 is Koblitz curve (e.g. Short Weierstrass curve with a=0).
Koblitz curves allow using efficiently-computable GLV endomorphism ψ:
- GLV endomorphism ψ transforms a point:
P = (x, y) ↦ ψ(P) = (β·x mod p, y)
- GLV scalar decomposition transforms a scalar:
k ≡ k₁ + k₂·λ (mod n)