Does the security of RSA come from just the carries in multiplication? Although it's hard for me to find a reference, it's my understanding that if you calculate $N = pq$ using $GF(2)$ polynomial multiplication rather than ordinary multiplication, it is easy to factor $N$ under this type of multiplication.
I might have the terminology wrong when I say &quot;$GF(2)$ polynomial multiplication&quot;.  I mean carryless or &quot;XOR&quot; multiplication done in base 2.
Is this true, and if so, does it mean that the security of RSA comes entirely from the addition carries that happen during ordinary multiplication?
might have the terminology wrong when I say &quot;GF(2) polynomial multiplication&quot;

You are thinking of multiplication in the ring of binary polynomials, that is polynomials with coefficients in the Galois Field with 2 elements. That set is noted $GF(2)[x]$. It's addition reduces to XOR of the coefficients of equal weight. It's multiplication is called &quot;carryless multiplication&quot; in computing. It supports an analog to Euclidean division, and modular arithmetic.

It's my understanding that if you calculate $N=pq$ using (this) multiplication rather than ordinary multiplication, it is easy to factor $N$.

Yes. There are efficient algorithms for factoring binary polynomials into irreducible polynomials (which are analogs to primes in the ring of binary polynomials).

Does it mean that the security of RSA comes entirely from the addition carries that happen during ordinary multiplication?

True, RSA is not secure if we remove the carries (in the additions within it's multiplication by the schoolbook algorithm). I can't agree with &quot;security .. comes entirely&quot;. Analogy: a chain is insecure if one removes it's last link, yet it's security does not come entirely from that link.