That is probably for others here to answer but I will give it a shot.

We are looking for an elliptic curve which has a cyclic subgroup with a high order (but not higher than `2^256`

as we want to work with 32byte private keys and the private keys are the orders of the elements with respect to the generator point) this particular elliptic curve over that prime field seems to fulfill these properties.

The order of the subgroup basically defines the difficulty for the discret logarithm. If the subgroup for example was of an order so small that one could store all group ements on a computer one could just compute it and break any public key coming from that group.

As for the generator point. I believe this is an arbitrary choice. Since the group is cyclic (and afaik of prime order) any other element (unless the neutral one) could have served as the generator. However we need to agree on a fixed generator point for ecdsa to have the same results every time we run the algorithms. Therefor one element was chosen.

I am not sure if there is more theory as to why this particular configuration seems preferable.

What do you mean by "admitting an efficient endomorphism"? I know the meaning of the word endomorphism. But where and how is it being used? I could open a separate question if that was necessary. – Rene Pickhardt – 2019-03-18T06:51:02.073

@Rene Pickhardt: the optimization to use the efficiently-computable endormorphism to speed up elliptic curve computations is called the Gallant-Lambert-Vanstone method, but the details probably warrant their own question – Pieter Wuille – 2019-03-19T07:42:21.920