Add or multiply any two elements and you stay inside the field. In 𝔽₇, 5 + 3 = 1 because 8 leaves remainder 1 on division by 7.
E / 𝔽₉₇
y² = x³ + 2x + 3
y² = x³ + 2x + 3
A LITTLE STRUCTURE.
A LOT OF POSSIBILITY.
A LOT OF POSSIBILITY.
AN EXPLORABLE FIELD GUIDE · 01A finite world.
A finite world.
Endless possibilities.
Small sets. Beautiful rules. The surprisingly rich mathematics behind keeping a secret.
FINITE FIELDS✳ELLIPTIC CURVES✳GROUP LAWS✳SHARED SECRETS✳FINITE FIELDS
01 / THE FIELDWhat goes around,
What goes around,
comes around.
In a finite field, arithmetic has a way home.
Pick two numbers. Watch the remainder do the work.
=
Every non-zero element has a multiplicative inverse.
That's what makes it a field.
NOTHING FALLS OUTSIDE THE SYSTEM.ALL ROADS LEAD TO A RESIDUE.
FINITE DOESN'T MEAN SIMPLEOnly a handful
Only a handful
of numbers.
A whole universe
of behaviour.
To divide by 3 in 𝔽₇, multiply by 5: their product is 15 ≡ 1. Zero has no inverse. Some rules survive every change of scenery.
Every finite field has pⁿ elements for a prime p and integer n ≥ 1, and is unique up to isomorphism. For n > 1, it is not simply the integers modulo pⁿ.
02 / THE CURVEA curve without
A curve without
the curve.
Over a finite field, a smooth silhouette becomes a constellation. Every dot satisfies the same equation. Together with a point at infinity, they form a group.
y² = x³ + 2x + 2 (mod 17)18 DOTS + 𝒪
POINT ON EYOUR POINT kP
ONE POINT. NINETEEN PLACES.Add a point.
Add a point.
Then add it again.
Start with P = (5, 1). Repeated addition visits every point in this group before returning to the identity, 𝒪.
0P19P
YOU LANDED AT(3, 1)
The connecting trail records the order of visits; it is not a continuous curve.
03 / THE SECRETMeet in public.
Meet in public.
Agree in private.
Choose private numbers. Exchange public points.
Arrive at the same shared point.
A tiny demonstration of elliptic-curve Diffie–Hellman.
These small numbers are for learning, not security.
ALICE3
Publishes A = aP
BOB7
Publishes B = bP
FIELD NOTESA few things
A few things
worth knowing.
Where does the security come from?
Given P and kP, recovering k is the elliptic-curve discrete logarithm problem. Suitable large prime-order groups make known classical attacks expensive. Our 19-point group is deliberately easy to search. Real protocols also need authentication, key derivation and careful implementation.
Why does the curve need to be non-singular?
For y² = x³ + ax + b in characteristic other than 2 or 3, require 4a³ + 27b² ≠ 0 in the field. This rules out cusps and self-intersections and gives the elliptic-curve group law its intended setting. Our example has 4·2³ + 27·2² ≡ 4 (mod 17), so it passes.
What is the point at infinity?
The extra point 𝒪 is the identity: P + 𝒪 = P. The inverse of (x, y) is (x, −y), with coordinates reduced modulo p. Adding a point to its inverse gives 𝒪. In the explorer, 0P and 19P both land there.
How are points actually added?
For distinct x-coordinates, set m = (y₂ − y₁)/(x₂ − x₁). For doubling a point with y ≠ 0, use m = (3x₁² + a)/(2y₁). Then x₃ = m² − x₁ − x₂ and y₃ = m(x₁ − x₃) − y₁. All arithmetic is in the field. Opposite points sum to 𝒪.
04 / AN ATLAS OF APPLICATIONSOne field.
One field.
Many directions.
Arithmetic becomes a language for secrecy, resilience, geometry and exact computation. Choose a branch; follow the idea.
THE COMMON GROUND𝔽q
q = pn · p prime · n ≥ 1
01 / PROTECTElliptic-curve cryptography
A finite field supplies coordinates; a non-singular curve supplies a group. Repeated point addition gives key agreement and, with additional constructions, digital signatures.
A = aP, B = bP, aB = bA
These are two different arithmetic settings: coordinates lie in 𝔽p, while scalar multiplication is periodic modulo the order r of P. Here p = 17 and r = 19. Production schemes use carefully selected groups and protocols, not merely larger examples.
Continue: double-and-add, projective coordinates, authenticated key exchange, ECDSA and EdDSA. X25519 uses the field with p = 2255 − 19; its curve has a different equation from this toy example. [1]
Return to the shared-secret explorer02 / REPAIRError-correcting codes
Encode k symbols as the coefficients of a polynomial of degree less than k. Evaluate at n distinct field elements. The extra evaluations make lost or damaged information recoverable.
[n, k, d] = [n, k, n − k + 1]
Two different message polynomials agree at at most k − 1 positions: their difference is a non-zero polynomial of degree at most k − 1. This proves the Reed–Solomon minimum distance. Any k intact evaluations recover the message; mixed errors e and erasures s are uniquely correctable when 2e + s ≤ n − k.
Continue: storage redundancy, communication channels, BCH codes and algebraic-geometric codes. [2]
Damage a message in the coding lab03 / MIXBytes as field elements
A byte can represent a polynomial of degree at most seven over 𝔽₂. Addition is XOR; multiplication is polynomial multiplication followed by reduction. This is arithmetic in 𝔽₂₅₆, not integer arithmetic modulo 256.
𝔽₂[x] / (x⁸ + x⁴ + x³ + x + 1)
AES uses this field in its substitution and mixing operations. Its S-box uses inversion, with zero handled separately, followed by an affine transformation. Field arithmetic is one component of the cipher; inversion alone is not encryption.
Continue: polynomial bases, efficient reduction, the AES S-box and MixColumns. [3]
Try the same construction with three bits04 / DISTRIBUTESecret sharing
Shamir's t-of-n scheme puts the secret at f(0), then distributes evaluations f(xᵢ) at distinct non-zero field elements. Choose the remaining t − 1 coefficients independently and uniformly.
f(x) = s + a₁x + ⋯ + at−1xt−1
Any t shares interpolate the polynomial. With fewer than t, every possible secret is consistent with the observed shares and has the same likelihood. This is information-theoretic privacy, under the stated randomness assumptions. It is different from Diffie–Hellman, where two parties derive a new shared secret.
Continue: Lagrange interpolation, verifiable secret sharing, threshold signatures and multiparty computation. A real scheme also needs secure randomness and protection against malicious shares. [4]
05 / ARRANGEFinite geometry
Projective points are one-dimensional subspaces of 𝔽q³. Scaling a non-zero vector does not change its point. Projective lines are two-dimensional subspaces.
#PG(2, q) = (q³ − 1)/(q − 1) = q² + q + 1
Each line contains q + 1 points. For q = 2 this gives the seven-point Fano plane, with three points on every line. Incidence structures connect linear algebra to combinatorial designs and codes.
Continue: projective planes, incidence matrices, linear groups and Singer cycles. Multiplication by a primitive element of 𝔽q³, modulo the scalars 𝔽q×, gives a cyclic group acting regularly on the projective points. The projective action is the relevant object; an SL lift need not have the same order.
06 / UNDERSTANDGalois theory in miniature
In characteristic p, (a + b)p = ap + bp. The Frobenius map a ↦ ap is therefore a field automorphism, and generates the cyclic Galois group of 𝔽pⁿ/𝔽p.
Gal(𝔽pⁿ/𝔽p) ≅ ℤ/nℤ
Inside 𝔽pⁿ, a subfield with pd elements exists exactly when d divides n. Conjugates, trace and norm become explicit computations: Tr(a) = a + ap + ⋯ + apⁿ⁻¹, and N(a) = a(pⁿ−1)/(p−1).
Continue: irreducible polynomials, normal bases, field towers and the Galois correspondence. [5]
Follow a Frobenius orbit below07 / COUNTArithmetic geometry
Count the solutions of a curve over 𝔽q, then over its extensions. These counts encode more than the drawing: they reveal the action of Frobenius.
#E(𝔽q) = q + 1 − t, |t| ≤ 2√q
Hasse's bound constrains elliptic-curve point counts. Our curve over 𝔽₁₇ has 19 points, so t = −1. Over 𝔽qⁿ, the count is qn + 1 − αn − βn, where α + β = t and αβ = q.
Continue: point-counting algorithms, zeta functions, endomorphisms, and pairings whose values live in multiplicative groups of extension fields. [6]
08 / COMPUTEExact polynomial algorithms
Finite-field operations avoid floating-point round-off. This makes fields useful for polynomial interpolation, modular factorisation and exact linear algebra. Computations over several primes can be combined by the Chinese remainder theorem.
Aj = Σi=0N−1 aᵢωij
When a prime p satisfies N | (p − 1), 𝔽p contains a primitive Nth root ω. The resulting number-theoretic transform is an exact analogue of a discrete Fourier transform. Fast radix decompositions depend on the factorisation of N.
Continue: NTT convolution, modular reconstruction and lattice-based cryptography. ML-KEM uses coefficients modulo 3329 in a polynomial quotient ring. That ring is not itself a finite field; the distinction matters. [7]
05 / BUILD A BIGGER FIELDThree bits.
Three bits.
Eight possibilities.
A prime field is a beginning. Adjoin a root of an irreducible polynomial, and the arithmetic acquires new dimensions.
DEFINITION / THE CONSTRUCTION
𝔽₈ = 𝔽₂[α], α³ = α + 1
Every element is c₀ + c₁α + c₂α², with cᵢ ∈ {0, 1}. The cubic x³ + x + 1 has no root in 𝔽₂; a cubic without a root is irreducible. Reduction therefore produces a field.
FOLLOW THE FIRST ELEMENT
Each orbit step squares the element. Three steps return to the start: a⁸ = a. Trace and norm land back in 𝔽₂.
FROM HERE TO A BYTE
Replace degree three by degree eight to construct 𝔽₂₅₆. The mechanism is unchanged: XOR coefficients, multiply polynomials, reduce by an irreducible modulus. AES chooses a specific modulus [3].
06 / LET THE MESSAGE SURVIVELose a piece.
Lose a piece.
Keep the meaning.
Three message symbols become seven evaluations over 𝔽₁₁. Damage the transmission; see exactly when the algebra can repair it.
RECEIVED / SELECT SYMBOLS TO DAMAGE
IntactErased: position knownChanged: value wrong
This small decoder checks all 11³ possible messages. It uses the received symbols, not the original coefficients. Efficient real decoders use polynomial algorithms.
Why can it recover four erasures, but only two unknown errors?
This [7, 3] Reed–Solomon code has distance 5. Three surviving values determine a polynomial of degree at most two. An erased symbol has a known missing position; an error has both an unknown position and an unknown correction. The unique-decoding guarantee is 2e + s ≤ 4. Outside that bound, recovery may still happen in a particular example, but it is not guaranteed. [2]