Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
For the rest of this class, we will consider only the two most used cases
in cryptography: q=p, with p a prime and q=2m. The former case,
GF(p), is denoted as the prime field, whereas the latter, GF(2m), is
known as the finite field of characteristic two or simply binary field.
Finite Fields
elements.
The field F2m
‘Plegaria del Codificador teórico: Juro por Galois que seré leal a las nobles
tradiciones de la teoría de códigos; que hablaré de ella en el secreto lenguaje sólo
conocido por los contados iniciados; y que celosamente vigilaré la sagrada teoría de
aquellos que quisieran profanarla para usarla en aplicaciones mundanas”.
J. L. Massey
Although the description of the field F2m is complicated, this field is extremely
beautiful and also quite useful, because its computations can be done efficiently
when implemented in hardware. There are several ways to describe arithmetic in
F2m; the most common one is the so-called polynomial representation.
Generating polynomial
The finite field F=GF(2m) is completely described by a monic irreducible
polynomial, often called generating polynomial, of the form
f x x m k m 1x m 1 k m 2 x m 2 ... k1x k0
m 1
A ai i
i 0
Where all the coefficients aI's belong to the characteristic field
GF(2). Elements of the field are m-bit strings. The rules for
arithmetic in F can be defined by polynomial representation. Since
F operates on bit strings, computers can perform arithmetic in this
field very efficiently.
Order definition
• The order of an element in F, is defined as the smallest positive integer k
such that k=1. Any finite field always contains at least one element, called
a primitive element, which has order q-1. We say that f(x) is a primitive
polynomial, if any one of its roots, say , is a primitive element in F. If f(x)
is primitive, then all the q elements of F, can be expressed as the union of
the zero element and the set of the first q-1 powers of ,
0, , 2 , 3 , , q1 1
In fact, this is always the case for any finite field F=GF(2m) where we can
always define the so-called polynomial basis of GF(2m) over GF(2) as as
the linearly independent set of the first m powers of
f(x) = x4 + x + 1
f() = 4 + + 1 = 0
4 = + 1.
Using the above equation, one can now express each one of the
15 nonzero elements of K over F as is shown in the next table.
Discrete log table
i i Coordinates
0 1 (0 0 0 1)
1 (0 0 1 0)
2 2 (0 1 0 0)
3 3 (1 0 0 0)
4 4=+1 (0 0 1 1)
5 5=2+ (0 1 1 0)
6 6=3+2 (1 1 0 0)
7 7=3++1 (1 0 1 1)
8 8=2+1 (0 1 0 1)
9 9=3+ (1 0 1 0)
10 10=2++1 (0 1 1 1)
11 11=3+2+ (1 1 1 0)
12 12=3+2++1 (1 1 1 1)
13 13=3+2+1 (1 1 0 1)
14 14=3+1 (1 0 0 1)
Finite fields: definitions and
operations
FF22m finite
finitefield
fieldoperations
operations::Addition,
Addition,Squaring,
Squaring,
m
multiplicationand
multiplication andinversion
inversion
Arithmetic in the field F2m
The irreducible generating polynomial used for these sample
calculations is again f(x) =x4+x+1.
Notice that all the coefficients are reduced modulo 2!!
Addition
(0110)+(0101)=(0011).
Multiplication
(1101)(1001)
= (x3+x2+1)(x3+1) mod f(x)
= x6+x5+2x3+x2+1 mod f(x)
= x6+x5+x2+1 mod f(x)
= (x4+x+1)(x2+x)+(x3+x2+x+1) mod f(x)
= x3+x2+x+1
= (1111).
Arithmetic in the field F2m
Exponentiation
To compute (0010)4, first find
(0010)2 = (0010)(0010)
= x x mod f(x)
= x2
= (0100).
Then
(0010)4 = (0010)2(0010)2
= (0100)(0100)
= x2x2 mod f(x)
= (x4+x+1)(1)+(x+1) mod f(x)
=x+1
= (0011).
Two-steps Multipliers
In most algorithms the modular product is computed in two
steps: polynomial multiplication followed by modular reduction.
Let A(x), B(x) and (x) GF(2m) and P(x) be the irreducible field
generator polynomial.
In order to compute the modular product we first obtain the product
polynomial C(x), of degree at most 2m-2, as
m 1 m 1
Polynomial productC x A x B x a i b i
i i
2m-1 coordinates i 0 i 0
• Then, in the second step, a reduction operation is performed in order
to obtain the m-1 degree polynomial C’(x) is defined as
P x x 6 x 5 x 4 x 1
{am-1xm-1+am-2xm-2+...+a2x2+a1x+a0|ai= 0 or 1}.
a0).
{aF
Fact: The field m-1x
has +a
m-1
m-2x
exactly
m-2+...+a x2+a x+a |a = 0 or 1}.
q-1=22m-1 nonzero
1 0 i
elements plus