Finite Field Calculator (GF(2ⁿ) and GF(p))
Add, multiply, divide, invert and raise elements of GF(2ⁿ) or GF(p) to a power, find an element’s order, and check that the reducing polynomial is irreducible and primitive. Every step is shown.
How to Use
- Pick the field: GF(2ⁿ) (bytes and bit patterns, as in AES and QR codes) or GF(p) (integers mod a prime).
- For GF(2ⁿ), type the reducing polynomial as hex (
0x11B) or as text (x^8+x^4+x^3+x+1); the line under it says whether it is irreducible and primitive. For GF(p), type the prime. - Choose the operation: add, subtract, multiply, divide, inverse, power or order.
- Enter a (and b or the exponent k). Use
0x,0borx^notation, or set how plain numbers are read (hex or decimal). - Or press a preset, such as the FIPS-197 example {57}·{83} = {C1}.
- Read the result in the readout and follow the shift-and-XOR or extended-Euclid steps in Show Work.
Worked Example
AES: {57}·{83} in GF(2⁸) with m(x) = x⁸ + x⁴ + x³ + x + 1 (0x11B). This is the example in FIPS-197, section 4.2. As polynomials, {57} = x⁶ + x⁴ + x² + x + 1 and {83} = x⁷ + x + 1. Multiplying them, with coefficients added mod 2, gives x¹³ + x¹¹ + x⁹ + x⁸ + x⁶ + x⁵ + x⁴ + x³ + 1 (0x2B79). That has degree 13, too big for a byte, so reduce: XOR with m(x)·x⁵ (0x2360) leaves 0x0819 = x¹¹ + x⁶ + x⁴ + x³ + 1; XOR with m(x)·x³ (0x08D8) leaves 0xC1 = x⁷ + x⁶ + 1. So {57}·{83} = {C1}.
The xtime shortcut: {57}·{13}. Multiplying by {02} is a left shift, then XOR with {1B} if a bit fell off the top. {57}·{02} = {AE}, ·{04} = {47}, ·{08} = {8E}, ·{10} = {07}. Since {13} = {10} ⊕ {02} ⊕ {01}, the product is {07} ⊕ {AE} ⊕ {57} = {FE} (FIPS-197, section 4.2.1).
The common mistake: ordinary arithmetic. 0x57 × 0x83 as integers is 87 × 131 = 11,397, and 11,397 mod 256 = 133 = 0x85, not 0xC1. Addition goes wrong the same way: 0x57 + 0x83 = 0xDA as integers, but the field sum is 0x57 ⊕ 0x83 = 0xD4. Integers mod 256 are not even a field, because 2 has no inverse there.
GF(p): the inverse of 3 in GF(7). Extended Euclid gives 7 = 2·3 + 1, so 1 = 7 − 2·3, and −2 ≡ 5 (mod 7). Check: 3 × 5 = 15 = 2 × 7 + 1, so 3⁻¹ = 5.
Show Work
Formulas
Galois Fields, and Why AES Uses GF(2⁸)
Évariste Galois (1811–1832) first set out the idea of a finite field in his 1830 paper Sur la théorie des nombres, published in the Bulletin des Sciences Mathématiques; he died after a duel in May 1832, aged 20. In 1893 E. H. Moore proved the classification still used today: a finite field has a prime-power number of elements, a field of every prime-power size exists, and all fields of the same size are isomorphic. Moore also introduced the notation GF(q), for “Galois field”.
GF(2ⁿ) exists for every n because there is an irreducible polynomial of every degree over GF(2), and any one of them works as m(x). There are 30 irreducible polynomials of degree 8, and 16 of them are primitive. Different choices give the same field with the bytes relabelled, which is why AES (0x11B) and QR codes (0x11D) can disagree on what {02}·{80} is and both be correct.
AES works on bytes, and the 256 byte values are exactly the elements of GF(2⁸): addition is a single XOR and multiplication by a constant is a few shifts and XORs. Joan Daemen and Vincent Rijmen built Rijndael’s S-box from the map x → x⁻¹ in GF(2⁸), one of Kaisa Nyberg’s constructions for S-boxes with low input–output correlation and low difference propagation, and then added an affine transformation because the bare inverse has too simple an algebraic expression. NIST published Rijndael as AES in FIPS-197 on 26 November 2001.
Sources: FIPS-197, Advanced Encryption Standard (NIST, 2001, sections 4.1–4.2, and the S-box in section 5.1.1), Daemen & Rijmen, AES Proposal: Rijndael (section 7.2, S-box design). The QR code field is from ISO/IEC 18004, which is paywalled, so it was checked against two open sources instead: Thonky’s QR code tutorial (step 5, byte-wise modulo 100011101) and Project Nayuki’s QR code generator (multiplication modulo 0x11D, generator 0x02).
About This Calculator
This calculator does arithmetic in GF(2ⁿ) for any n from 1 to 16 with a reducing polynomial you choose, and in GF(p) for any prime up to 2³¹ − 1. It adds, subtracts, multiplies, divides, inverts and raises to a power, finds the multiplicative order of an element and says whether it is a generator, and checks the reducing polynomial for irreducibility and primitivity before trusting it.
The field arithmetic uses exact integers only, never floating point. Show Work lists each partial product and reduction XOR, each extended-Euclid row, or each square-and-multiply step. All calculations run in your browser; nothing you enter is sent to a server.
It is meant for developers checking AES, Reed–Solomon or CRC code, and for students of coding theory and abstract algebra. To find out which kind of math a pasted problem is, try the Math Inspector.
Related calculators: CRC Calculator, Bitwise Calculator, and Number Base Converter.
Frequently Asked Questions
Why is addition just XOR in GF(2ⁿ)?
Each element is a polynomial whose coefficients are bits, and coefficients are added mod 2, so 1 + 1 = 0 with no carry. Adding the polynomials bit by bit is exactly XOR: {57} + {83} = {D4}. For the same reason subtraction is identical to addition, and every element is its own negative.
Is the AES polynomial 0x11B primitive?
It is irreducible but not primitive. With m(x) = x⁸ + x⁴ + x³ + x + 1, the element {02} (that is, x) has order 51, so its powers reach only 51 of the 255 non-zero bytes. {03} (x + 1) has order 255 and is a generator, so log/antilog tables for the AES field are built on a generator such as {03}. The field itself is fine: irreducible is all a field needs.
Which finite field do QR codes use?
QR code Reed–Solomon error correction works in GF(256) with the polynomial x⁸ + x⁴ + x³ + x² + 1 (binary 100011101, 0x11D, 285 decimal), and 2 is a generator. Powers of 2 wrap at 256 by XOR with 285: 2⁸ = 29, 2⁹ = 58 and 2¹² = 205. Try the QR preset to see 2 has order 255.
How do I find a multiplicative inverse in GF(2⁸)?
Either run the extended Euclidean algorithm on a(x) and m(x), or raise a to the power 254, because a²⁵⁵ = 1 for every non-zero a. In the AES field {53}⁻¹ = {CA}, since {53}·{CA} = {01}. Zero has no inverse; the AES S-box simply maps {00} to itself at that step.
Why can’t I just use integers mod 256?
Integers mod 256 are not a field: 2 has no inverse because 2·x is always even. Ordinary arithmetic also gives different answers: 0x57 × 0x83 = 11,397, and 11,397 mod 256 = 0x85, while the field product is 0xC1. Integers mod n form a field only when n is prime; for 256 = 2⁸ you need polynomial arithmetic.
How do I use the Finite Field Calculator (GF(2ⁿ) and GF(p))?
Just type your numbers. The answer shows up right away — there is no button to press. Change anything and it updates by itself.
Does it cost anything or need an account?
No. The tool is completely free, there is no account to create, and it keeps working offline after the page first loads.
Is anything I type uploaded?
No. The tool works entirely on your device, so the values you enter never leave your browser.
Common Use Cases
AES byte arithmetic
Check a hand xtime calculation: {57}·{13} = {57} ⊕ {AE} ⊕ {07} = {FE}. The S-box starts from the inverse, {53}⁻¹ = {CA}, and its affine step then gives S({53}) = {ED}.
QR code Reed–Solomon tables
Rebuild the antilog table for the 0x11D field: 2⁸ = 29, 2⁹ = 58, 2¹⁰ = 116, 2¹² = 205. All 255 non-zero bytes appear exactly once, because 2 is a generator.
LFSR and BCH polynomial choice
A primitive polynomial gives a maximum-length sequence: x⁴ + x + 1 makes x run through all 15 non-zero states of GF(16). x⁸ + 1 = (x + 1)⁸ is reducible and fails the check.
Testing table-driven code
Compare your log/antilog lookups with direct shift-and-XOR. In GF(16) with x⁴ + x + 1: log 7 = 10 and log B = 7, 10 + 7 = 17 ≡ 2 (mod 15), and 2² = 4, so 7·B = 4.
Number theory homework
In GF(7) the inverse of 3 is 5, because 3 × 5 = 15 = 2 × 7 + 1. 3 has order 6 and is a generator; 2 has order 3 and is not.
Last updated: