|
| 1 | +# Binary Fields |
| 2 | + |
| 3 | +This module implements binary fields of the form $GF(2^{2^n})$ (i.e. a finite field with $2^{2^n}$ elements) by constructing a tower of field extensions. It doesn't implement `IsField` or `FieldElement`, because we wanted elements from different field extensions to coexist within the same struct, allowing us to optimize each operation to work simultaneously across all levels. |
| 4 | + |
| 5 | +Binary fields are particularly useful for verifiable computing applications, including SNARKs and STARKs, due to their efficient implementation and favorable properties. |
| 6 | + |
| 7 | +## Overview |
| 8 | + |
| 9 | +The tower of binary fields provides a powerful alternative to prime fields for cryptographic applications. This implementation represents field elements as multivariable polynomials with binary coefficients in $GF(2) = \{0, 1\}$, where these coefficients are stored as bits in a `u128` integer. The tower structure is built recursively, with each level representing an extension of the previous field. |
| 10 | + |
| 11 | +Key features of this implementation: |
| 12 | + |
| 13 | +- Supports field extensions from level 0 $(GF(2))$ to level 7 $(GF(2^{128}))$. |
| 14 | +- Efficient arithmetic operations optimized for binary fields. |
| 15 | +- Karatsuba optimization for multiplication. |
| 16 | + |
| 17 | +## Implementation Details |
| 18 | + |
| 19 | +### Tower Construction |
| 20 | + |
| 21 | +Let's explain the theory behind. To expand the binary field $GF(2) = \{0, 1\}$, we construct a tower of field extensions in the following way: |
| 22 | + |
| 23 | +**Level 0:** The tower starts at level 0 with the base field of two elements $GF(2^{2^0}) = \{0, 1\}$. |
| 24 | + |
| 25 | +**Level 1:** Then at level 1, we define the field extension $GF(2^{2^1})$ whose elements are univariate polynomials with binary coefficients and variable $x_0$ such that ${x_0}^2 = x_0 + 1$. Note that this means that the polynomials are lineal (have degree at most 1). Therefore, this field extension has $2^{2^1}$ elements. We represent them as the binary expression of integers: |
| 26 | + |
| 27 | +$$\begin{aligned} |
| 28 | +00 &= 0 \\ |
| 29 | +01 &= 1 \\ |
| 30 | +10 &= x_0 \\ |
| 31 | +11 &= x_0 + 1 |
| 32 | +\end{aligned}$$ |
| 33 | + |
| 34 | +**Level 2:** At level 2, we define the field extension $GF(2^{2^2})$. In this case the elements are polynomials with binary coefficients and two variables, $x_0$ and $x_1$. The first one keeps satisfying ${x_0}^2 = x_0 + 1$ and in addition the second one satisfies ${x_1}^2 = x_1 \cdot x_0 + 1$. This means that the polynomials are lineal in each variable. Therefore, this field extension has $2^{2^2}$ elements: |
| 35 | + |
| 36 | +$\begin{array}{llll} |
| 37 | +0000 = 0 & 0100 = x_1 & 1000 = x_1x_0 & 1100 = x_1x_0 + x_1 \\ |
| 38 | +0001 = 1 & 0101 = x_1 + 1 & 1001 = x_1x_0 + 1 & 1101 = x_1x_0 + x_1 + 1 \\ |
| 39 | +0010 = x_0 & 0110 = x_1 + x_0 & 1010 = x_1x_0 + x_0 & 1110 = x_1x_0 + x_1 + x_0 \\ |
| 40 | +0011 = x_0 + 1 & 0111 = x_1 + x_0 + 1 & 1011 = x_1x_0 + x_0 + 1 & 1111 = x_1x_0 + x_1 + x_0 + 1 |
| 41 | +\end{array}$ |
| 42 | + |
| 43 | +**Level 3:** At level 3, we define $GF(2^{2^3})$ in the same way. This time the polynomials have three variables $x_0$, $x_1$ and $x_2$. The first two variables satisfy the equations mentioned before and in addition the last one satisfies ${x_2}^2 = x_2 \cdot x_1 + 1$. This field extension has $2^{2^3}$ elements. |
| 44 | + |
| 45 | +**Level $n$:** Continuing this argument, in each level $n$ we define the field extension $GF(2^{2^n})$ using polynomials of $n$ variables with ${x_i}^2 = x_i \cdot x_{i-1} + 1$. |
| 46 | + |
| 47 | +Our implementation admits until level $n = 7$. |
| 48 | + |
| 49 | + |
| 50 | + |
| 51 | +### Element Representation |
| 52 | + |
| 53 | +A `TowerFieldElement` is represented by: |
| 54 | + |
| 55 | +- `value`: A `u128` integer where the bits represent the coefficients of the polynomial. |
| 56 | +- `num_level`: The level in the tower (0-7). |
| 57 | + |
| 58 | +For example, if `value = 0b1101` and `num_level = 2`, this represents the polynomial $x_0\cdot x_1 + x_1 + 1$ in $GF(2^4)$. |
| 59 | + |
| 60 | + |
| 61 | +### Field Operations |
| 62 | + |
| 63 | +The implementation provides efficient algorithms for: |
| 64 | + |
| 65 | +- Addition and subtraction (XOR operations). |
| 66 | +- Multiplication using a recursive tower approach with Karatsuba optimization. |
| 67 | +- Inversion using Fermat's Little Theorem. |
| 68 | +- Exponentiation using square-and-multiply. |
| 69 | + |
| 70 | +## API Usage |
| 71 | + |
| 72 | +### Creating Field Elements |
| 73 | + |
| 74 | +The method `new` handles possible overflows in this way: |
| 75 | +- If the level input is greater than 7, then the element's `num_level` is set as 7. |
| 76 | +- If the value input doesn't fit in the level given, then we take just the less significant bits that fit in that level and set it as the element's `value`. |
| 77 | + |
| 78 | +```rust |
| 79 | +use lambdaworks_math::field::fields::binary::field::TowerFieldElement; |
| 80 | + |
| 81 | +// Create elements at different tower levels |
| 82 | +let element_level_0 = TowerFieldElement::new(1, 0); // Element '1' in GF(2) |
| 83 | +let element_level_1 = TowerFieldElement::new(3, 1); // Element '11' in GF(2^2) |
| 84 | +let element_level_2 = TowerFieldElement::new(123, 2); // Element '1011' in GF(2^4) |
| 85 | +let element_level_3 = TowerFieldElement::new(123, 3); // Element '01111011'in GF(2^8) |
| 86 | +let element_level_7 = TowerFieldElement::new(123, 25); // Element '0..01111011'in GF(2^128) |
| 87 | + |
| 88 | +// Create zero and one |
| 89 | +let zero = TowerFieldElement::zero(); |
| 90 | +let one = TowerFieldElement::one(); |
| 91 | + |
| 92 | +// Create from integer values |
| 93 | +let from_u64 = TowerFieldElement::from(42u64); |
| 94 | +``` |
| 95 | + |
| 96 | +### Basic Operations |
| 97 | + |
| 98 | +```rust |
| 99 | +use lambdaworks_math::field::fields::binary::field::TowerFieldElement; |
| 100 | + |
| 101 | +// Create two elements |
| 102 | +let a = TowerFieldElement::new(5, 2); // '0101' in GF(2^4) |
| 103 | +let b = TowerFieldElement::new(3, 2); // '0011' in GF(2^4) |
| 104 | + |
| 105 | +// Addition (XOR operation) |
| 106 | +let sum = a + b; // '0110' = 6 |
| 107 | + |
| 108 | +// Subtraction (same as addition in binary fields) |
| 109 | +let difference = a - b; // '0110' = 6 |
| 110 | + |
| 111 | +// Multiplication |
| 112 | +let product = a * b; // '1111' = 15 |
| 113 | + |
| 114 | +// Inversion |
| 115 | +let a_inverse = a.inv().unwrap(); |
| 116 | +assert_eq!(a * a_inverse, TowerFieldElement::one()); |
| 117 | + |
| 118 | +// Exponentiation |
| 119 | +let a_cubed = a.pow(3); |
| 120 | +``` |
| 121 | + |
| 122 | +### Working with Different Levels |
| 123 | + |
| 124 | +```rust |
| 125 | +use lambdaworks_math::field::fields::binary::field::TowerFieldElement; |
| 126 | + |
| 127 | +// Elements at different levels |
| 128 | +let a = TowerFieldElement::new(3, 1); // Level 1: GF(2^2) |
| 129 | +let b = TowerFieldElement::new(5, 2); // Level 2: GF(2^4) |
| 130 | + |
| 131 | +// Operations automatically promote to the higher level |
| 132 | +let sum = a + b; // Result is at level 2 |
| 133 | +assert_eq!(sum.num_level(), 2); |
| 134 | + |
| 135 | +// Splitting and joining elements |
| 136 | +let element = TowerFieldElement::new(0b1010, 2); // Level 2 |
| 137 | +let (hi, lo) = element.split(); // Split into two level 1 elements |
| 138 | +assert_eq!(hi.value(), 0b10); // High part: '10' |
| 139 | +assert_eq!(lo.value(), 0b10); // Low part: '10' |
| 140 | + |
| 141 | +// Join back |
| 142 | +let rejoined = hi.join(&lo); |
| 143 | +assert_eq!(rejoined, element); |
| 144 | +``` |
| 145 | + |
| 146 | +## Applications |
| 147 | + |
| 148 | +Binary tower fields are particularly useful for: |
| 149 | + |
| 150 | +1. **SNARKs and STARKs**: These fields enable efficient proof systems, especially when working with binary operations. |
| 151 | + |
| 152 | +2. **Binius**: A SNARK system that leverages binary fields for improved performance and simplicity. |
| 153 | + |
| 154 | + |
| 155 | +## Performance Considerations |
| 156 | + |
| 157 | +- Operations in binary fields are generally faster than in prime fields for many applications. |
| 158 | +- XOR-based addition/subtraction is extremely efficient. |
| 159 | +- The tower structure enables optimized implementations of multiplication and other operations. |
| 160 | + |
| 161 | +## References |
| 162 | + |
| 163 | +- [SNARKs on Binary Fields: Binius](https://blog.lambdaclass.com/snarks-on-binary-fields-binius/) - LambdaClass Blog |
| 164 | +- [Binius: SNARKs on Binary Fields](https://vitalik.eth.limo/general/2024/04/29/binius.html) - Vitalik Buterin's explanation |
| 165 | +- [Binary Tower Fields are the Future of Verifiable Computing](https://www.irreducible.com/posts/binary-tower-fields-are-the-future-of-verifiable-computing) - Irreducible |
0 commit comments