1. Finite Fields The first examples of finite fields are quotient fields of the ring of integers Z: let t > 1 and define Z /t = Z/(tZ) to be the ring of congruence classes of integers modulo t: in practical terms, we identify the clases with the remainders {0, 1,, t 1} and define the sum and product modulo t. Then Z t is a field iff t is a prime. For a prime q, we denote this field by F q. Let F be any finite field with sum a + b and multiplication ab, for all a, b F. There exist necessarily two distinct elements in F, the 0 (defined as the unique element such that 0 + a = a + 0 = a for all a F) and the 1 (defined as the unique element such that 1a = a1 = a for all a F \ {0}). The multiplicative subgroup of non-zero elements of F is denoted by F. There is a naturally defined homomorphism of rings from Z to F ϕ : Z F : ϕ(t) = t 1 = t i=1 1 if t > 0 t i=1 1 if t < 0 0 if t = 0 We denote ϕ(t) simply as t. The kernel of ϕ is an ideal qz Z, with q > 0 necessarily a prime, as otherwise, if q = st with both s > 1 and t > 1, 0 = ϕ(st) = ϕ(s)ϕ(t) and F would contain divisors of zero. So there exists a injective homomorphism of F q into F and, identifying F q with its image, we may consider F q as a subfield of F; it is called the prime subfield of F and q is called the characteristic of F. This implies that F is a vector space over F q of finite dimension m and so F = q m. This field is denoted as F q m, a notation that hints, implicitely, to the fact that a finite field with that given cardinality is essentially unique. When there is no ambiguity, we will denote this field simply as F, but will use sistematically the notation F q for the prime fields. The vector space structure described above completely determines the additive structure of F: it is isomorphic to a direct product of m copies of F q ; given a basis u 1,, u m, the elements of F may be identified with the corresponding vectors of coordinates with respect to that basis and sum is performed component wise. 1.1. Polynomials over F. In this subsection F denotes a field, not necessarily finite. Denote by F[x] the ring and F-vector field of polynomials (in a variable x) with coefficients in F. If p(x) = n i=0 a ix i with a n 0, deg(p(x)) = n denotes the degree of p(x). p(x) is monic if a n = 1. Obviously, for every polynomial p(x) F[x] there exists unique a F and monic g(x) such that f(x) = ag(x). The well known division algorithm of polynomials shows that Lemma 1. For any f(x), g(x) F[x], with g(x) not the zero polynomial, there exist unique polynomials u(x) and r(x) satisfying f(x) = u(x)g(x) + r(x), 1 deg(r(x)) < deg(g(x)).
2 If r(x) = 0, we say that g(x) divides f(x): g(x) f(x). On the basis of this division Lemma, an Euclidean algorithm is defined, giving rise to the proof of the existence of the gcd(f(x), g(x)) of two nonzero polynomials, similarly to what happens in Z. If i) h(x) f(x), h(x) g(x) and ii) (v(x) f(x) v(x) g(x)) = v(x) h(x), then also ch(x) has the same property, for any c F. We thus define gcd(f(x), g(x)) as the unique monic polynomial satisfying i) and ii). Again as in Z, there exist polynoials u(x) and v(x) such that gcd(f(x), g(x)) = u(x)f(x) + v(x)g(x). Definition 2. f(x) F[x] with positive degree is irreducible if f(x) = g(x)h(x) implies that at least one of these factors is a constant (a degree 0 polynomial). Monic irreducible polynomials play the same role in F[x] that primes do in Z. In particular, if f(x) is monic and irreducible, and f(x) g(x)h(x) then f(x) divides one of the factors in the product. And each monic polynomial has a unique, up to order of the factors, decomposition as a product of monic irreducible polynomials. Definition 3. a F is called a root of f(x) F[x] if f(a) = 0 (considering f(x) as a function on F) or, equivalentely, if (x a) f(x). By induction on the degree, for instance, one proves that Proposition 4. If deg(f(x)) = k > 0 then f(x) has no more than k roots. 1.2. Orders and Primitive Elements. Let again F = F q m. The understanding of the multiplicative structure of F starts with the following basic property, verified by any finite abelian group: Proposition 5 (Fermat/Euler). For every a F, a qm 1 = 1. Equivalentely, for every a F, a qm = a. Proof. The equivalence of both statements is obvious. Suppose a 0 and let the nonzero elements of the field be indexed as a i, 1 i < q m. The mapping is a bijection. So F F, q m 1 a qm 1 i=1 a i = q m 1 i=1 a i aa i aa i = q m 1 which implies the result, because q m 1 i=1 a i 0. Definition 6. For any a F, the order of a is defined as Proposition 7. For any a, b F, i) ord(a) (q m 1); ii) ord(a j ) = ord(a) gcd(j,ord(a)) ; i=1 ord(a) = min{k > 0 : a k = 1}. a i,
3 iii) If ord(a) = s, ord(b) = t and gcd(s, t) = 1, then ord(ab) = st. Proof. HW For each t (q m 1) let O(t) = {a F : ord(a) = t}. If a O(t) then {1, a, a 2, a t 1 } are the roots of x t 1; so, in this case, and taking into account the properties of the order, O(t) = {a j : 1 j < t; gcd(j, t) = 1}, and O(t) = φ(t), where φ denotes the Euler function. Therefore, q m 1 = F = O(t) φ(t) t (q m 1) t (q m 1) But t K φ(t) = K for any K; this may be shown as follows: for each s K there is a bijection λ : U(s) = {1 j K : gcd(j, K) = K } {1 v s : gcd(v, s) = 1} s given by λ(j) = v such that j = v K s ; so U(s) = φ(s) and K = s K U(s) = s K φ(s). We conclude that O(t) = φ(t) for every t (q m 1) (ie, O(t) is always nonempty). In particular Proposition 8. If F = F q m, there exist exactly φ(q m 1) elements a F with order ord(a) = q m 1. An α F with order ord(α) = q m 1 is called a primitive element or primitive root of the field. The multiplicative structure of F is in this way completely determined: F is a cyclic group (of order q m 1) {α i : 0 i < q m }. When a primitive element α is known, multiplications in the field are turned into sums by means of a table of logarithms : for any c, d F cd = α s α t = α s+t. Example 9. 2 is a primitive element of F 11 ; the following table presents the correspondance between exponents 0 j < 10 in the first row and field elements 2 j in the second: 0 1 2 3 4 5 6 7 8 9 1 2 4 8 5 10 9 7 3 6 It is easy to see that if α is a primitive element then α j is primitive if and only if gcd(j, q m 1) = 1 (HW). The following map, the Frobenius automorphism) of F over F q, is essential for the theory: Proposition 10. Let σ : F F be defined by σ(a) = a q. Then σ is a field automorphism, ie, it is bijective and satisfies σ(a + b) = σ(a) + σ(b) and σ(ab) = σ(a)σ(b). Furthermore, σ(a) = a iff a F q. Proof. HW
4 The Frobenius automorphism of F over F q is naturally extended to an automorphism of F[x] (both as a ring and as a F q vector space) defined by σ( n i=0 a ix i ) = n i=0 σ(a i)x i (HW). 1.3. Extensions. The existence and explicit construction of finite fields other than the prime fields follows from the following result: Proposition 11. Let f(x) F q [x] be an irreducible polynomial of degree m. Then the quotient ring F q [x]/(f(x)) is a field with q m elements. Proof. HW This field may be seen, in an informal way, as the set of polynomials with coefficients in F q and degree less than m (the remainders upon division by f(x)), with the operations of sum and product done modulo f(x). It is more convenient to denote by a new symbol, say β, the congruence class of x in the quotient and identify F with F q [β], the field obtained from F q by adding the new element β; this new element satisfies f(β) = 0 and this equality determines the operations of sum and product: 1, β,, β m 1 is a basis of F over F q ; given a, b F a = m 1 i=0 s i β i, b = m 1 i=0 t i β i with a i, b i F q the sum and product are obtained as the usual sum and product of the polynomial expressions; the product, which is a polynomial expression of degree less or equal than 2m 2 is then reduced to a linear combination of the powers β i, 0 i < m, by the repeated use of the equality f(β) = 0. Remark 12. This construction of the field F as a finite algebraic extension of F q, is no different from the maybe more familiar extensions of the rational field, as Q[ 2] Q[x]/(x 2 2), which may appear more natural only because we consider, implicitely, Q as a subfield of the algebraically closed field C, where 2 exists, so to speak. However, as in our case, that extension of the rationals is completely independent of this inclusion and is valid also inside other algebraic completions of Q, such as the p-adic fields. Example 13. The simplest of all non-trivial examples of this construction is the following: x 2 +x+1 F 2 [x] is irreducible. We may then represent F = F 2 [x]/(x 2 + x + 1) as F = {0, 1, β, β + 1}. The sum and product tables are easily deduced: for instance β(β + 1) = 1, etc. The construction of finite extensions of F q depends on the existence and knowledge of irreducible polynomials f(x) F q [x]. On the other hand, given such a polynomial f(x), and the corresponding field F q [β], as above, we have Claim 14. f(x) splits completely over F q [β], ie, it decomposes as the product of distinct degree 1 factors m 1 f(x) = (x β qs ). s=0 Proof. HW. Hint: Use the Frobenius automorphism. As a consequence, f(x) (x qm x), as we will see now:
5 Proposition 15. If h(x) F q [x] is irreducible and deg(h(x)) = t then h(x) (x qm x) iff t m. Proof. Let F = F q [x]/(h(x)) = F q [β] and consider the equality x qm x = u(x)h(x) + r(x), with deg(r(x)) < t. Suppose first that t m. We have that, for any c F and every j > 0, c qtj = c (HW); in particular, c qm = c for all c F. This implies that the t distinct roots of h(x) in F must also be roots of r(x), which can happen only if r(x) = 0. Conversely, suppose that h(x) (x qm x); this implies that σ m (β) = β qm = β. Let α be a primitive element of F (ie, an element of F with order q t 1); there exist v l F q, 0 l < t, such that α = t 1 l=0 v lβ l ; applying the Frobenius automorphism again t 1 t 1 σ m (α) = v l σ m (β l ) = v l beta l = α. l=0 So α qm 1 = 1 and (q t 1) (q m 1), which can only happen if t m (HW). l=0 Corollary 16. In F q [x], x qm x = h(x) where the product runs over all irreducible polynomials with degree dividing m. 1.3.1. Minimal polynomials. Definition 17. Given a F = F q m, the minimal polynomial of a over F q is the (unique) monic polynomial p a (x) F q [x] of minimum degree such that p a (a) = 0. We state several properties of minimal polynomials: Proposition 18. 1. p a (x) exists and is unique; 2. p a (x) is irreducible; 3. If p(x) F q [x] is a monic irreducible polynomial and p(a) = 0 for some a F, then p(x) = p a (x); 4. p a (x) x qm x and so deg(p a (x)) m; 6. if α is a primitive element of F q m then deg(p α (x)) = m. Proof. HW. The first example of a minimal polynomial was already provided by the construction of F = F q [β] = F q [x]/(f(x)) itself, as it is easily seen that f(x) is the minimal polynomial of β. It should be noticed, however, that F = F q [β] does not imply that β is a primitive element of the field: take, for example, F 3 [x]/(x 3 + x 2 + 2). Remark 19. We notice that, as a consequence of 6. in the previous proposition, the construction of a finite field as the quotient of the polynomial ring F q [x] by the ideal generated by a monic irreducible polynomial f(x) of degree m gives rise to all possible finite fields F of cardinality q m. We consider now the question of existence and computation of irreducible polynomials.
6 1.4. Factorizations and Cyclotomic Polynomials. 1.4.1. Möbius function and Inversion Formula. We start with some general facts about arithmetic functions: Definition 20. A function f : N C is multiplicative if f(mn) = f(m)f(n) for any coprime integers m and n. Proposition 21. If f : N C is a multiplicative function, then F : N C, F (n) = d n f(d) is also multiplicative. Proof. HW. Definition 22. The Möbius function µ : N { 1, 0, 1} is defined as 1 if n = 1 µ(n) = ( 1) k if n is squarefree with k distinct prime factors 0 otherwise The function µ is obviously multiplicative and it satisfies the following Theorem 23. For any n N µ(d) = d n { 1 if n = 1 0 otherwise Proof. For n = 1 the result is obvious. Suppose that n > 1 and, if n has the prime factorization n = t i=1 pki i (with k i > 0), define rad(n) = t i=1 p i. It is clear µ(d) = µ(d) d n d rad(n) as for other divisors of n the corresponding summand is zero by definition. Let p be one of the prime factors of n; then µ(d) = µ(d) + µ(d) = µ(pd) + µ(d) = d rad(n) d rad(n),p d = d rad(n/p) d rad(n),p d (µ(d) + µ(p)µ(d)) = d rad(n/p) d rad(n/p) (µ(d) µ(d)) = 0 d rad(n/p) The main property of the Möbius function is expressed in the following fundamental result: Theorem 24 (Möbius Inversion Formula). Suppose f : N N and F : N N is defined by F (n) = f(d); d n then f(n) = d n µ(d)f ( n d ).
7 Proof. The proof consists in a straightforward computation: ( n ) µ(d)f = µ(d) f(t) = f(t) µ(d) = f(n) d d n d n t n/d t n d n/t as a consequence of the previous theorem. A similar argument proves Theorem 25. Suppose f : N N and F : N N is defined by F (n) = f(d); d n then f(n) = d n ( ( n )) µ(d) F. d Proof. HW. We apply this theorem to obtain a formula for the number of irrreducible polynomials, of given degree n, over F q : denote this number as I q (n); we saw before that x qm x factors over F q as the product of all monic irreducible polynomials with degree dividing m; equating degrees, we have q m = d m di q (d). Möbius Inversion formula implies that, for any n Z +, I q (n) = 1 µ(d)q n/d. n d n In particular, I q (n) > 0, thus assuring the existence of irreducible polynomials and so of field extensions of F q of any given degree. 1.4.2. Cyclotomic Polynomials. Let F be any field containing the group of n-th roots of unity, or more precisely an isomorphic copy of it. This may be C but it may also be F q m for m such that n q m 1. a is a primitive n-th root of unity if n is the least positive integer such that a n = 1, ie, if n is the order of a in the multiplicative group F. Definition 26. The n-th cyclotomic polynomial over F is defined as Φ n (x) = (x z). a:ord(a)=n Basic properties of polynomials imply the factorization in F[x] Theorem 27. x n 1 = d n Φ d(x). The same argument used in the proof of the second version of Möbius Inversion Formula gives us an explicit formula for the cyclotomic polynomials: Proposition 28. For n Z +, Φ n (x) = d n(x n/d 1) µ(d).
8 Proof. HW. As a consequence, we have Lemma 29. Let p be prime and n, k Z+. Then { Φn (x p ) if p n 1. Φ pn (x) = Φ n(x p ) Φ n(x) if p n Φ n (x pk ) if p n 2. Φ pk n(x) = Φ n(x pk ) if p n Φ n(x pk 1 ) Proof. HW. Hint: In 1. apply the Inversion Formula for cyclotomic polynomials. In the case p n, notice that if d pn then either d n or d n and p 2 d; in the case p n, notice that the divisors of pn are either divisors of n or of the for pd with d n. 2. is a easy consequence of 1. Cyclotomic polynomials were defined above by their factorization over a field, but we may also define them by the inversion formula as stated in the last proposition. It is then possible to prove directly that they have integer coefficients. Moreover, we have the following theorem, which we state without proof: Theorem 30. For n Z +, Φ n (x) is irreducible over Z. On the other hand, if F = F q m, an application of the properties of the Frobenius automorphism off over F q shows that we may consider Φ n (x) F q [x] (HW). However, the cyclotomic polynomials Φ n (x) are not, in general, irreducible over F q : consider, for example, the case n = q m 1; then, assuming that α is a primitive element in F = F q m, we have the facorization Φ n (x) = (x α i ); 0<i<q m 1;gcd(i,q m 1)=1 but the minimal polynomial of each of these α i over F q has degree m. We conclude that, over this field, Φ q m 1(x) factors as a product of degree m irreducible polynomials. 1.4.3. Cyclotomic cosets and Factorizaton. Given a primitive element α of F, we may compute the minimal polynomial p α i(x) (which we will denote now simply by p i (x)) of any other nonzero element, using the notion of cyclotomic cosets: Definition 31. For any n co-prime to q, the cyclotomic coset of i modulo n, with respect to q, is C i = {iq j mod n : j 0}; in other words, C i is the orbit of i Z /n under the mapping Z /n Z n x xq. Obviously, the cyclotomic cosets partition Z n ; {i 1,, i s } is called a complete set of representatives of cyclotomic cosets if {C i1,, C is } are a partition of Z /n.
9 Example 32. The cyclotomic cosets modulo 26 with respect to 3: {0}, {1, 3, 9}, {2, 6, 18}, {4, 12, 10}, {5, 15, 19}, {7, 21, 11}, {8, 24, 20}, {13}, {14, 16, 22}, {17, 25, 23}. The cyclotomic cosets modulo 16 with respect to 3: {0}, {1, 3, 9, 11}, {2, 6}, {4, 12}, {5, 15, 13, 7}, {8}, {10, 14}. Remark 33. Let m be the order of q in Z /n, ie m, the minimal positive integer such that n (q m 1). If C i is the cyclotomic coset of i modulo n, with respect to q, it is clear that C i = u where u is the least positive integer such that i(q u 1) 0 mod n; it follows that C i = m if gcd(i, n) = 1; on the other hand, if gcd(i, n) = v > 1 and n 1 = n/v, then we get from the same equation that C i = p where p is the order of q in Z n1 and so, in any case, p m. We have Theorem 34. Let α be a primitive element of F q m. The minimal polynomial of α i over F q is p i (x) = j C i (x α j ), where C i is the cyclotomic coset of i modulo q m 1, with respect to q. Proof. α i is obviously a root of the given polynomial. We verify that p i (x) F q [x]; p i (x) has no multiple roots; any polynomial f(x) that has α i as a root is divisible by p i (x). The details of the proof are left as an exercise (HW). Corollary 35. Let α be a primitive element of F q m and {i 1,, i r } a complete set of representatives of the cyclotomic cosets modulo q m 1, with respect to q. Then r x qm 1 1 = p ij (x). j=1 Example 36. p(x) = x 3 + 2x + 1 is irreducible over F 3, so we may take F 27 to be F 3 [α] where α is a root of p(x). It turns out that α is also a primitive element. The
10 following table gives the correspondence between powers of α and the expression of the same element on the basis 1, α, α 2 : 0 1 9 α + 1 18 α 2 + 2α + 1 1 α 10 α 2 + 2 19 2α 2 + 2α + 2 2 α 2 11 α 2 + α + 2 20 2α 2 + α + 1 3 α + 2 12 α 2 + 2 21 α 2 + 1 4 α 2 + 2α 13 2 22 2α + 2 5 2α 2 + α + 2 14 2α 23 2α 2 + 2α 6 α 2 + α + 1 15 2α 2 24 2α 2 + 2α + 1 7 α 2 + 2α + 2 16 2α + 1 25 2α 2 + 1 8 2α 2 + 2 17 2α 2 + α The cyclotomic cosets found before allow us to factor x 26 1 over F 3 : {0} x 1 {1, 3, 9} (x α)(x α 3 )(x α 9 ) = x 3 + 2x + 1 {2, 6, 18} (x α 2 )(x α 6 )(x α 18 ) = x 3 + x 2 + x + 2 {4, 12, 10} (x α 4 )(x α 12 )(x α 10 ) = x 3 + x 2 + 2 {5, 15, 19} (x α 5 )(x α 15 )(x α 19 ) = x 3 + 2x 2 + x + 1...... We have Φ 26 (x) = x 12 x 11 + x + 1; over F 3 this polynomial factors as the product of 4 irreducible polynomials of degree 3, two of which are computed above. At this point, we may clarify the claim of uniqueness of finite fields: Theorem 37. Let q be a prime and m 1. There exists a unique, up to isomorphism, field F q m with cardinality q m. Proof. The existence of the field follows from the existence of an irreducible polynomial f(x) F q [x] with degree m, which will be proved later. As to uniqueness, and taking into account the observation made in remark 20 above, suppose that f(x) and g(x) are two irreducible polynomials of the same degree m. Let α be a primitive element of F q [x]/(f(x)) and F q [x]/(g(x)) = F q [β]. g(x) divides x qm 1 1, so we must have g(x) = p i (x) for some i, ie, g(x) is the minimal polynomial of α i for some i, ie, F q [β] F q [αi] F q [α]. But the two fields have the same cardinality so we have equality. We have also the following generalization of Corollary 35: Theorem 38. Suppose that gcd(q, n) = 1 and that m is the order of q in Z n. Let α be a primitive element of F q m and {i 1,, i r } a complete set of representatives of the cyclotomic cosets modulo n, with respect to q. Then the following factorization holds in F q [x]: r x n 1 = p ijs(x) where s = qm 1 n. j=1
11 Proof. Under the conditions in the statement, α s is a primitive n-th root of identity in F q [α] and so, over this field, n 1 x n 1 = (x α js ); j=0 the n exponent values are partitioned as a disjoint union of cyclotomic cosets modulo q m 1 because if a coset contains a multiple of s then all its elements are also multiples of s; on the other hand, the mapping Z /n Z /(qm 1), i is is well defined, injective, and it preserves cyclotomic cosets with respect to q, ie, i and j are in the same coset modulo n if and only if is and js are in the same coset modulo q m 1; this implies that a complete system of representatives of cosets modulo n corresponds, by this map, to a complete system of representatives of the cosets modulo q m 1 that contain the multiples of s. So, for each 1 v r, we obtain an irreducible factor p ivs(x) = (x α i ) i C iv s where C ivs denotes the cyclotomic coset modulo q m 1; if C ivs = h, h 1 p ivs(x) = (x α ivsqj ). j=0 The details of the argument are left as an exercise (HW). Example 39. Consider the polynomial x 16 1 F 3 [x]; a complete system of representatives for the cyclotomic cosets modulo 16, with respect to q = 3, was obtained above: {0, 1, 2, 4, 5, 8, 10}. As 3 4 1 = 16 5, we must use a primitive element α of F 81. Define F 81 = F 3 [x]/(x 4 + x + 2) = F 3 [α]. By the previous theorem, we have the factorization and, for instance, while x 16 1 = p 0 (x)p 5 (x)p 10 (x)p 20 (x)p 25 (x)p 40 (x)p 50 (x), p 0 (x) = (x α 0 ) = x 1 p 10 (x) = (x α 10 )(x α 30 ) = x 2 (α 10 + α 30 )x + α 40 = x 2 + x + 2 The computation of the other factors is left as an exercise (HW). 1.5. Supplementary Results and Problems. Lemma 40. For any q, u, v > 1, gcd(q u 1, q v 1) = q gcd(u,v) 1. Proof. HW. Hint: Analize the application of Euclides s algorithm to the two pairs of integers Exercise 41. Find a primitive element and construct a logarithmic table for F 25.
12 Exercise 42. Find the irreducible factors of x 24 1 over Z and over F 7. Exercise 43. Verify if each one of the following polynomials is irreducible over F 2 : a) x 4 + x 3 + 1; b) x 8 + x 7 + x 6 + x 5] + x 4 + x + 1. Exercise 44. Let F 2 [α] bedefined as F 2 [x]/(x 5 + x 2 + 1) (ie, α 5 + α 2 + 1 = 0). Is this a field? Rewrite as a sum of monomials with coefficients in F 2 the polynomial (x α)(x α 2 )(x α 4 )(x α 8 )(x α) 16 ). Proposition 45. The trace of a F q m, defined as T r(a) = m 1 j=0 a qj, satisfies i) T r(a) F q a F q m; ii) T r(a + b) = T r(a) + T r(b) a, b F q m; iii) T r(ta) = tt r(a) t F q, a F q m; iv) For each t F q, T r(x) = t has q m 1 distinct solutions. Proof. HW).