Binary fields (F₂ and its extensions)

Finite fields of characteristic 2. The elements of F₂ᵏ are exactly the k-bit strings — there is a bijection between bytes and F₂⁸ — and the arithmetic is what makes them attractive to implementers binius:

• Addition is XOR. No carries, no modular reduction.
• Squaring is much cheaper than general multiplication, because (x + y)² = x² + y² holds in characteristic 2. The identity is sometimes called the "freshman's dream", and here it is true.
• F₂ is the smallest field there is, with two elements.

They have a long history in cryptography outside proof systems: AES uses F₂⁸, GMAC uses F₂¹²⁸, and binary-field elliptic curves have efficient circuit instantiations. polyxor128 (2026) is the newest of these: a keyed universal hash whose per-block step is carryless multiplication, ordinary multiplication in GF(2)[x], run on the same hardware instructions the proof-system corpus above uses for a different purpose. It is this spoke's first source where the field-size argument shows up in symmetric- key hashing rather than polynomial commitment — see universal-hash.

Why proof systems came to them

SNARK performance has tracked field size downward — ~256-bit elliptic-curve groups, then 64-bit primes like Plonky2's Goldilocks, and binius argues the endpoint is F₂. Smaller elements mean cheaper arithmetic, less storage and better cache behaviour.

The specific win is on bit-heavy computation. SHA-256 and Keccak are built from AND and XOR, which a large prime field represents wastefully and a binary field represents natively. Those hash functions are what blockchain rollups and post-quantum signature schemes need proven in bulk, so the field choice and the application are the same decision binius flock.

Embedding overhead is the obstacle that had to be removed first: committing a one-bit value as an element of a large field means paying for space that carries no information. binius's Brakedown adaptation commits small-field polynomials with none.

Towers, and a live disagreement

A tower builds F₂, F₂², F₂⁴, F₂⁸ … as a chain of extensions, each layer sitting over the last, which gives efficient inversion (Fan–Paar) and a natural way to move between element sizes. Towers are in the title of binius.

flock does not use them. Its new zerocheck challenge points process log|F| bit claims with roughly two bit-shifts and XORs per input without relying on tower-fields, "which are less efficient than direct extensions of F₂", and it works in F₂¹²⁸ throughout. Both papers are in the same family, both are over binary fields, and they disagree about whether the tower earns its keep. This spoke's first flagged contradiction — see synthesis. Neither paper benchmarks the tower question in isolation, so the disagreement is stated rather than settled.

Where the mathematics lives

Finite-field theory, Reed–Solomon codes and proximity gaps are ../mathematics-wiki's subject when taught as theory. Here they appear as components of a construction with a benchmark attached. If a coding- theory or algebra text arrives, it routes there and this page links to it.

Related

binius · flock · polyxor128 · universal-hash · succinct-argument · concrete-efficiency · synthesis