# Why does AES use a Binary Field?

The key idea in AES is the use of matrix multiplication and the corresponding inverse (as opposed to Feistel). But the algorithm does that using a GF instead of simple modular arithmetic.

Is there any obvious reason to not use simple modular arithmetic?

• You could do the arithmetic modulo $2^n$. However, that has some nasty properties (not all elements have multiplicative inverses, higher order bits do not affect lower order ones), and while you could get around these issues, it would require significant changes to AES.
• You could do the arithmetic modulo a prime $p$. That avoids the above issues, however the issue here is that our plaintext and ciphertext blocks are even sets of bits; elements modulo a prime $p$ are not (except for $p=2$, which doesn't sound interesting). Hence, you'd need to add some special logic to handle that.
By using $GF(2^8)$, they avoid all the above issues; all nonzero elements have inverses, in a multiplication (or inverse), every input bit potentially affects every output bit, and a part of a block fits nicely in a field element.
• @Tuntable: no, I'm not saying that no (4x4) matrix in $Z/256$ is invertible (counterexample, the identity matrix is invertible); however, we can't make an sbox based on the multiplicative inverse in $Z/256$ (as half the elements don't have inverses); in general, multiplication modulo 256 just does not have the properties that AES relies on for security. Commented Mar 9, 2017 at 4:16