p3-binary-field

The Wiedemann binary tower GF(2) ⊂ GF(4) ⊂ … ⊂ GF(2^128), providing characteristic-2 field arithmetic as a building block toward binary-field SNARKs.

Key items:

• Gf2 — the base field GF(2)
• BinaryField2, BinaryField4, BinaryField8, BinaryField16, BinaryField32, BinaryField64, BinaryField128 — the tower levels, each a quadratic extension of the one below
• BasedVectorSpace / ExtensionField between every pair of byte-aligned levels, in the tower basis
• BinaryChallenger — Fiat–Shamir over a byte challenger; every bit pattern is a field element, so no rejection sampling is needed
• Carryless-multiply fast paths for BinaryField64 and BinaryField128 on x86-64 (pclmulqdq) and AArch64 (aes)

Little-endian targets only. The tower-basis coefficients of an element are borrowed in place as a slice of the level below, which is sound only where the byte layout coincides with the numeric representation; a compile-time assertion rejects big-endian targets.

from_u64 and the other PrimeCharacteristicRing integer constructors go through the prime subfield GF(2), so they carry the parity of their argument rather than its bit pattern: from_u64(2) is zero. from_le_bytes and interpolation_node are the bit-pattern constructors.

Two deliberate scope boundaries:

• TowerLevel — the trait carrying LOG_BITS, from_repr, to_repr and mul_alpha — is pub(crate), keeping the public surface minimal. Downstream crates work through the p3-field traits instead; exporting it later is an additive change.
• Arithmetic is unpacked: Packing is Self at every level, so elements are never bit-packed into SIMD lanes. A packed representation is a separate design.

Part of Plonky3, dual-licensed under MIT and Apache 2.0.