It's ten o'clock, you wait five hours, and it's three. Not fifteen. Nobody finds this strange, nobody had to learn a new rule, and everyone has been doing this calculation since childhood. This is exactly the arithmetic that Bitcoin operates on, from the first to the last calculation, and it has a name: modular arithmetic.
A finite field is a set with a finite number of elements within which the four operations work and never produce anything outside of it. In the case of Bitcoin, the elements are the integers from zero to p minus one, and the rule is simple: do the calculation as you always have and keep the remainder of the division by p.
Adding, subtracting, and multiplying are straightforward. In a field of modulus 7, five plus four equals two, because nine divided by seven leaves a remainder of two. Three times five equals one, because fifteen leaves a remainder of one. Subtracting is adding the opposite: minus three is the same as four, since three plus four completes the entire clock.
Division requires a new idea, and it's the most important idea of the lesson. There are no decimals in a finite field, so dividing by a cannot mean splitting into pieces. It means multiplying by the inverse of a — the number that, when multiplied by a, gives exactly one. In modulus 7, the inverse of three is five, because fifteen leaves a remainder of one. Dividing by three there is multiplying by five.
Now the question that answers the title: why does p need to be prime? Because only then does every element have an inverse. Try it on a clock with modulus twelve: the number four, multiplied by anything, only produces multiples of four, and none of them leave a remainder of one. Four has no inverse, division by four is impossible, and the set ceases to be a field. This happens with any number that shares a divisor with the modulus — and a prime modulus shares no divisor with anything below it.
Calculating the inverse in practice is done in two ways. Fermat's little theorem, from 1640, guarantees that a raised to the power of p minus one leaves a remainder of one; so a raised to the power of p minus two is the inverse, and an exponentiation solves it. Even faster is the extended Euclidean algorithm, a sequence of divisions known to the Greeks that returns the inverse in a few steps. Every wallet in the world runs one of these two, thousands of times per second, without anyone noticing.
The p of Bitcoin is this: 2 raised to the power of 256, minus 2 raised to the power of 32, minus 977. A prime number with seventy-eight decimal digits. The choice is not decorative — it was placed close to a power of two on purpose, because reducing a number modulo something so close to 2^256 is done with shifts and additions, without any division. It's the difference between an expensive operation and a cheap one, repeated billions of times.
One last caution, which avoids a common confusion from here on. There are two large numbers in the story, and they are different. The p is the size of the field, the clock where the coordinates of the points live. There is also n, the number of points the generator reaches, and it is the clock where private keys and the numbers of a signature live. Both are prime, both have 256 bits, and both are very close to each other — but confusing them produces calculations that seem correct but don't add up.
With the clock set, it's time to put the curve on top of it. In the next lesson, y² = x³ + 7, the points that satisfy this equation and the rule that adds two of them to produce a third.