I think I found two ways of approaching that "galois field in the exponent" idea I had: geometric algebra and blinding. Blinding is the easiest to explain: you have an element of GF(p^n) = a_0 + a_1 x + ... + a_{n-1} x^{n-1} that you wants to blind. You pick q such that p | q-1. You pick a generator g of a subgoup with order p. Then you blind each of the a_i by calculating g^{a_i}. You can add two blinded elements by multiplying each blinded term and then dividing by the corresponding terms of the primitive polynomial as many times as is necessary. You can multiply a blinded element by a non-blineded one by shifting & dividing in the obvious way. This isn't very cryptographically useful because p is usually small. But it illustrates the idea of a "logarithm" that behaves like a galois field in that when you multiply them, you add the field elements. In geometric algebra, one has various grades of elements: scalars, vectors, bivectors, etc. In 3-d geometric algebra, the unit blades are 1, e_1, e_2, e_3, e_1 e_2, e_2 e_3, e_3 e_1, and e_1 e_2 e_3. Since any vector squared is 1, we can do the same sort of thing with blades as with the blinded galois field: (e_1 e_2)(e_2 e_3) = e_1 e_3, 110+011 = 101. Of course, there's a lot more structure in geometric algebra, and it's not clear in either case how to do the modular reduction of the polynomial when one has the sum of two differently-graded elements like 1+e_1, but I thought the relationship between them was worth noting. It also begs the question of whether you can come up something like geometric algebra to deal with larger primes in the field: Say e_i cubed is 1 rather than squared. Looking at the "phase factor" we get when exchanging elements, e_1 e_2 e_1^2 = x e_2 e_1 e_1^2 = x e_2 but e_1 e_2 e_1^2 = x^2 e_1 e_1^2 e_2 = x^2 e_2 so x=x^2, x=0 or 1. The same sort of thing happens for all odd numbers, so it looks like whatever algebra would satisfy that relation would be symmetric and commutative. Can anyons come into play here? It seems like we can't get higher roots of 1 because multiplication is a binary operation. Is there any way to define a ternary "multiplication" that would give a phase factor of 2pi/3? Thanks, -- Mike Stay staym@clear.net.nz http://www.xaim.com/staym