Finite field

Existence and uniqueness

Let ${\displaystyle q=p^n}$ be a prime power, and ${\displaystyle F}$ be the splitting field of the polynomial $${\displaystyle P=X^q-X}$$ over the prime field ${\displaystyle \mathrm{G}\mathrm{F}(p)}$. This means that ${\displaystyle F}$ is a finite field of lowest order, in which ${\displaystyle P}$ has ${\displaystyle q}$ distinct roots (the formal derivative of ${\displaystyle P}$ is ${\displaystyle P^{\prime }=-1}$, implying that ${\displaystyle \mathrm{g}\mathrm{c}\mathrm{d}(P,P^{\prime })=1}$, which in general implies that the splitting field is a separable extension of the original). The above identity shows that the sum and the product of two roots of ${\displaystyle P}$ are roots of ${\displaystyle P}$, as well as the multiplicative inverse of a root of ${\displaystyle P}$. In other words, the roots of ${\displaystyle P}$ form a field of order ${\displaystyle q}$, which is equal to ${\displaystyle F}$ by the minimality of the splitting field.

The uniqueness up to isomorphism of splitting fields implies thus that all fields of order ${\displaystyle q}$ are isomorphic. Also, if a field ${\displaystyle F}$ has a field of order ${\displaystyle q=p^k}$ as a subfield, its elements are the ${\displaystyle q}$ roots of ${\displaystyle X^q-X}$, and ${\displaystyle F}$ cannot contain another subfield of order ${\displaystyle q}$.

In summary, we have the following classification theorem first proved in 1893 by E. H. Moore:

The order of a finite field is a prime power. For every prime power ${\displaystyle q}$ there are fields of order ${\displaystyle q}$, and they are all isomorphic. In these fields, every element satisfies $${\displaystyle x^q=x,}$$ and the polynomial ${\displaystyle X^q-X}$ factors as $${\displaystyle X^q-X=\prod _{a\in F}(X-a).}$$

It follows that ${\displaystyle \mathrm{G}\mathrm{F}(p^n)}$ contains a subfield isomorphic to ${\displaystyle \mathrm{G}\mathrm{F}(p^m)}$ if and only if ${\displaystyle m}$ is a divisor of ${\displaystyle n}$; in that case, this subfield is unique. In fact, the polynomial ${\displaystyle X^{p^m}-X}$ divides ${\displaystyle X^{p^n}-X}$ if and only if ${\displaystyle m}$ is a divisor of ${\displaystyle n}$.

Explicit construction

Non-prime fields

Given a prime power ${\displaystyle q=p^n}$ with ${\displaystyle p}$ prime and ${\displaystyle n>1}$, the field ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ may be explicitly constructed in the following way. One first chooses an irreducible polynomial ${\displaystyle P}$ in ${\displaystyle \mathrm{G}\mathrm{F}(p)[X]}$ of degree ${\displaystyle n}$ (such an irreducible polynomial always exists). Then the quotient ring $${\displaystyle \mathrm{G}\mathrm{F}(q)=\mathrm{G}\mathrm{F}(p)[X]/(P)}$$ of the polynomial ring ${\displaystyle \mathrm{G}\mathrm{F}(p)[X]}$ by the principal ideal generated by ${\displaystyle P}$ is a field of order ${\displaystyle q}$.

More explicitly, the elements of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ are the polynomials over ${\displaystyle \mathrm{G}\mathrm{F}(p)}$ whose degree is strictly less than ${\displaystyle n}$. The addition and the subtraction are those of polynomials over ${\displaystyle \mathrm{G}\mathrm{F}(p)}$. The product of two elements is the remainder of the Euclidean division by ${\displaystyle P}$ of the product in ${\displaystyle \mathrm{G}\mathrm{F}(p)[X]}$. The multiplicative inverse of a non-zero element may be computed with the extended Euclidean algorithm; see Extended Euclidean algorithm § Simple algebraic field extensions.

However, with this representation, elements of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ may be difficult to distinguish from the corresponding polynomials. Therefore, it is common to give a name, commonly ${\displaystyle \alpha }$ to the element of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ that corresponds to the polynomial ${\displaystyle X}$. So, the elements of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ become polynomials in ${\displaystyle \alpha }$, where ${\displaystyle P(\alpha )=0}$, and, when one encounters a polynomial in ${\displaystyle \alpha }$ of degree greater or equal to ${\displaystyle n}$ (for example after a multiplication), one knows that one has to use the relation ${\displaystyle P(\alpha )=0}$ to reduce its degree (it is what Euclidean division is doing).

Except in the construction of ${\displaystyle \mathrm{G}\mathrm{F}(4)}$, there are several possible choices for ${\displaystyle P}$, which produce isomorphic results. To simplify the Euclidean division, one commonly chooses for ${\displaystyle P}$ a polynomial of the form $${\displaystyle X^n+aX+b,}$$ which make the needed Euclidean divisions very efficient. However, for some fields, typically in characteristic ${\displaystyle 2}$, irreducible polynomials of the form ${\displaystyle X^n+aX+b}$ may not exist. In characteristic ${\displaystyle 2}$, if the polynomial ${\displaystyle X^n+X+1}$ is reducible, it is recommended to choose ${\displaystyle X^n+X^k+1}$ with the lowest possible ${\displaystyle k}$ that makes the polynomial irreducible. If all these trinomials are reducible, one chooses "pentanomials" ${\displaystyle X^n+X^a+X^b+X^c+1}$, as polynomials of degree greater than ${\displaystyle 1}$, with an even number of terms, are never irreducible in characteristic ${\displaystyle 2}$, having ${\displaystyle 1}$ as a root.

A possible choice for such a polynomial is given by Conway polynomials. They ensure a certain compatibility between the representation of a field and the representations of its subfields.

In the next sections, we will show how the general construction method outlined above works for small finite fields.

Field with four elements

The smallest non-prime field is the field with four elements, which is commonly denoted ${\displaystyle \mathrm{G}\mathrm{F}(4)}$ or ${\displaystyle {\mathbb{F}}_4.}$ It consists of the four elements ${\displaystyle 0,1,\alpha ,1+\alpha }$ such that ${\displaystyle {\alpha }^2=1+\alpha }$, ${\displaystyle 1\cdot \alpha =\alpha \cdot 1=\alpha }$, ${\displaystyle x+x=0}$, and ${\displaystyle x\cdot 0=0\cdot x=0}$, for every ${\displaystyle x\in \mathrm{G}\mathrm{F}(4)}$, the other operation results being easily deduced from the distributive law. See below for the complete operation tables.

This may be deduced as follows from the results of the preceding section.

Over ${\displaystyle \mathrm{G}\mathrm{F}(2)}$, there is only one irreducible polynomial of degree ${\displaystyle 2}$: $${\displaystyle X^2+X+1}$$ Therefore, for ${\displaystyle \mathrm{G}\mathrm{F}(4)}$ the construction of the preceding section must involve this polynomial, and $${\displaystyle \mathrm{G}\mathrm{F}(4)=\mathrm{G}\mathrm{F}(2)[X]/(X^2+X+1).}$$ Let ${\displaystyle \alpha }$ denote a root of this polynomial in ${\displaystyle \mathrm{G}\mathrm{F}(4)}$. This implies that $${\displaystyle {\alpha }^2=1+\alpha ,}$$ and that ${\displaystyle \alpha }$ and ${\displaystyle 1+\alpha }$ are the elements of ${\displaystyle \mathrm{G}\mathrm{F}(4)}$ that are not in ${\displaystyle \mathrm{G}\mathrm{F}(2)}$. The tables of the operations in ${\displaystyle \mathrm{G}\mathrm{F}(4)}$ result from this, and are as follows:

A table for subtraction is not given, because subtraction is identical to addition, as is the case for every field of characteristic 2. To divide, multiply by the reciprocal: ⁠${\displaystyle x/y=x\cdot (1/y)}$⁠. As in any field, division by zero is undefined. From the tables, it can be seen that the additive structure of ${\displaystyle \mathrm{G}\mathrm{F}(4)}$ is isomorphic to the Klein four-group, while the non-zero multiplicative structure is isomorphic to the group ${\displaystyle Z_3}$.

The map $${\displaystyle \phi :x\mapsto x^2}$$ is the non-trivial field automorphism, called the Frobenius automorphism, which sends ${\displaystyle \alpha }$ into the second root ${\displaystyle 1+\alpha }$ of the above-mentioned irreducible polynomial ${\displaystyle X^2+X+1}$.

GF(p2) for an odd prime p

For applying the above general construction of finite fields in the case of ${\displaystyle \mathrm{G}\mathrm{F}(p^2)}$, one has to find an irreducible polynomial of degree 2. For ${\displaystyle p=2}$, this has been done in the preceding section. If ${\displaystyle p}$ is an odd prime, there are always irreducible polynomials of the form ${\displaystyle X^2-r}$, with ${\displaystyle r}$ in ${\displaystyle \mathrm{G}\mathrm{F}(p)}$.

More precisely, the polynomial ${\displaystyle X^2-r}$ is irreducible over ${\displaystyle \mathrm{G}\mathrm{F}(p)}$ if and only if ${\displaystyle r}$ is a quadratic non-residue modulo ${\displaystyle p}$ (this is almost the definition of a quadratic non-residue). There are ${\displaystyle \frac{p-1}{2}}$ quadratic non-residues modulo ${\displaystyle p}$. For example, ${\displaystyle 2}$ is a quadratic non-residue for ${\displaystyle p=3,5,11,13,\dots }$, and ${\displaystyle 3}$ is a quadratic non-residue for ${\displaystyle p=5,7,17,\dots }$. If ${\displaystyle p\equiv 3\mathrm{mod}4}$, that is ${\displaystyle p=3,7,11,19,\dots }$, one may choose ${\displaystyle -1\equiv p-1}$ as a quadratic non-residue, which allows us to have a very simple irreducible polynomial ${\displaystyle X^2+1}$.

Having chosen a quadratic non-residue ${\displaystyle r}$, let ${\displaystyle \alpha }$ be a symbolic square root of ${\displaystyle r}$, that is, a symbol that has the property ${\displaystyle {\alpha }^2=r}$, in the same way that the complex number ${\displaystyle i}$ is a symbolic square root of ${\displaystyle -1}$. Then, the elements of ${\displaystyle \mathrm{G}\mathrm{F}(p^2)}$ are all the linear expressions $${\displaystyle a+b\alpha ,}$$ with ${\displaystyle a}$ and ${\displaystyle b}$ in ${\displaystyle \mathrm{G}\mathrm{F}(p)}$. The operations on ${\displaystyle \mathrm{G}\mathrm{F}(p^2)}$ are defined as follows (the operations between elements of ${\displaystyle \mathrm{G}\mathrm{F}(p)}$ represented by Latin letters are the operations in ${\displaystyle \mathrm{G}\mathrm{F}(p)}$): $${\displaystyle \begin{array}{cc}-(a+b\alpha )& =-a+(-b)\alpha \\ (a+b\alpha )+(c+d\alpha )& =(a+c)+(b+d)\alpha \\ (a+b\alpha )(c+d\alpha )& =(ac+rbd)+(ad+bc)\alpha \\ (a+b\alpha {)}^{-1}& =a(a^2-r{b}^2{)}^{-1}+(-b)(a^2-r{b}^2{)}^{-1}\alpha \end{array}}$$

GF(8) and GF(27)

The polynomial $${\displaystyle X^3-X-1}$$ is irreducible over ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ and ${\displaystyle \mathrm{G}\mathrm{F}(3)}$, that is, it is irreducible modulo ${\displaystyle 2}$ and ${\displaystyle 3}$ (to show this, it suffices to show that it has no root in ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ nor in ${\displaystyle \mathrm{G}\mathrm{F}(3)}$, as if a cubic factors then it must contain a linear factor). It follows that the elements of ${\displaystyle \mathrm{G}\mathrm{F}(8)}$ and ${\displaystyle \mathrm{G}\mathrm{F}(27)}$ may be represented by expressions $${\displaystyle a+b\alpha +c{\alpha }^2,}$$ where ${\displaystyle a,b,c}$ are elements of ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ or ${\displaystyle \mathrm{G}\mathrm{F}(3)}$ (respectively), and ${\displaystyle \alpha }$ is a symbol such that $${\displaystyle {\alpha }^3=\alpha +1.}$$

The addition, additive inverse and multiplication on ${\displaystyle \mathrm{G}\mathrm{F}(8)}$ and ${\displaystyle \mathrm{G}\mathrm{F}(27)}$ may thus be defined as follows; in following formulas, the operations between elements of ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ or ${\displaystyle \mathrm{G}\mathrm{F}(3)}$, represented by Latin letters, are the operations in ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ or ${\displaystyle \mathrm{G}\mathrm{F}(3)}$, respectively: $${\displaystyle \begin{array}{cc}-(a+b\alpha +c{\alpha }^2)& =-a+(-b)\alpha +(-c){\alpha }^2\text{(for }\mathrm{G}\mathrm{F}(8),\text{this operation is the identity)}\\ (a+b\alpha +c{\alpha }^2)+(d+e\alpha +f{\alpha }^2)& =(a+d)+(b+e)\alpha +(c+f){\alpha }^2\\ (a+b\alpha +c{\alpha }^2)(d+e\alpha +f{\alpha }^2)& =(ad+bf+ce)+(ae+bd+bf+ce+cf)\alpha +(af+be+cd+cf){\alpha }^2\end{array}}$$

GF(16)

The polynomial $${\displaystyle X^4+X+1}$$ is irreducible over ${\displaystyle \mathrm{G}\mathrm{F}(2)}$, that is, it is irreducible modulo ${\displaystyle 2}$. It follows that the elements of ${\displaystyle \mathrm{G}\mathrm{F}(16)}$ may be represented by expressions $${\displaystyle a+b\alpha +c{\alpha }^2+d{\alpha }^3,}$$ where ${\displaystyle a,b,c,d}$ are either ${\displaystyle 0}$ or ${\displaystyle 1}$ (elements of ${\displaystyle \mathrm{G}\mathrm{F}(2)}$), and ${\displaystyle \alpha }$ is a symbol such that $${\displaystyle {\alpha }^4=\alpha +1}$$ (that is, ${\displaystyle \alpha }$ is defined as a root of the given irreducible polynomial). As the characteristic of ${\displaystyle \mathrm{G}\mathrm{F}(2)}$ is ${\displaystyle 2}$, each element is its additive inverse in ${\displaystyle \mathrm{G}\mathrm{F}(16)}$. The addition and multiplication on ${\displaystyle \mathrm{G}\mathrm{F}(16)}$ may be defined as follows; in following formulas, the operations between elements of ${\displaystyle \mathrm{G}\mathrm{F}(2)}$, represented by Latin letters are the operations in ${\displaystyle \mathrm{G}\mathrm{F}(2)}$. $${\displaystyle \begin{array}{cc}(a+b\alpha +c{\alpha }^2+d{\alpha }^3)+(e+f\alpha +g{\alpha }^2+h{\alpha }^3)& =(a+e)+(b+f)\alpha +(c+g){\alpha }^2+(d+h){\alpha }^3\\ (a+b\alpha +c{\alpha }^2+d{\alpha }^3)(e+f\alpha +g{\alpha }^2+h{\alpha }^3)& =(ae+bh+cg+df)+(af+be+bh+cg+df+ch+dg)\alpha +\\ & (ag+bf+ce+ch+dg+dh){\alpha }^2+(ah+bg+cf+de+dh){\alpha }^3\end{array}}$$

The field ${\displaystyle \mathrm{G}\mathrm{F}(16)}$ has eight primitive elements (the elements that have all nonzero elements of ${\displaystyle \mathrm{G}\mathrm{F}(16)}$ as integer powers). These elements are the four roots of ${\displaystyle X^4+X+1}$ and their multiplicative inverses. In particular, ${\displaystyle \alpha }$ is a primitive element, and the primitive elements are ${\displaystyle {\alpha }^m}$ with ${\displaystyle m}$ less than and coprime with ${\displaystyle 15}$ (that is, 1, 2, 4, 7, 8, 11, 13, 14).

Multiplicative structure

The set of non-zero elements in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ is an abelian group under the multiplication, of order ${\displaystyle q-1}$. By Lagrange's theorem, there exists a divisor ${\displaystyle k}$ of ${\displaystyle q-1}$ such that ${\displaystyle x^k=1}$ for every non-zero ${\displaystyle x}$ in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$. As the equation ${\displaystyle x^k=1}$ has at most ${\displaystyle k}$ solutions in any field, ${\displaystyle q-1}$ is the lowest possible value for ${\displaystyle k}$. The structure theorem of finite abelian groups implies that this multiplicative group is cyclic, that is, all non-zero elements are powers of a single element. In summary:

The multiplicative group of the non-zero elements in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ is cyclic, i.e., there exists an element ${\displaystyle a}$, such that the ${\displaystyle q-1}$ non-zero elements of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ are ${\displaystyle a,a^2,\dots ,a^{q-2},a^{q-1}=1}$.

Such an element ${\displaystyle a}$ is called a primitive element of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$. Unless ${\displaystyle q=2,3}$, the primitive element is not unique. The number of primitive elements is ${\displaystyle \varphi (q-1)}$ where ${\displaystyle \varphi }$ is Euler's totient function.

The result above implies that ${\displaystyle x^q=x}$ for every ${\displaystyle x}$ in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$. The particular case where ${\displaystyle q}$ is prime is Fermat's little theorem.

Discrete logarithm

If ${\displaystyle a}$ is a primitive element in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$, then for any non-zero element ${\displaystyle x}$ in ${\displaystyle F}$, there is a unique integer ${\displaystyle n}$ with ${\displaystyle 0\le n\le q-2}$ such that ${\displaystyle x=a^n}$. This integer ${\displaystyle n}$ is called the discrete logarithm of ${\displaystyle x}$ to the base ${\displaystyle a}$.

While ${\displaystyle a^n}$ can be computed very quickly, for example using exponentiation by squaring, there is no known efficient algorithm for computing the inverse operation, the discrete logarithm. This has been used in various cryptographic protocols, see Discrete logarithm for details.

When the nonzero elements of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ are represented by their discrete logarithms, multiplication and division are easy, as they reduce to addition and subtraction modulo ${\displaystyle q-1}$. However, addition amounts to computing the discrete logarithm of ${\displaystyle a^m+a^n}$. The identity $${\displaystyle a^m+a^n=a^n\left(a^{m-n}+1\right)}$$ allows one to solve this problem by constructing the table of the discrete logarithms of ${\displaystyle a^n+1}$, called Zech's logarithms, for ${\displaystyle n=0,\dots ,q-2}$ (it is convenient to define the discrete logarithm of zero as being ${\displaystyle -\mathrm{\infty }}$).

Zech's logarithms are useful for large computations, such as linear algebra over medium-sized fields, that is, fields that are sufficiently large for making natural algorithms inefficient, but not too large, as one has to pre-compute a table of the same size as the order of the field.

Roots of unity

Every nonzero element of a finite field is a root of unity, as ${\displaystyle x^{q-1}=1}$ for every nonzero element of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$.

If ${\displaystyle n}$ is a positive integer, an ${\displaystyle n}$th primitive root of unity is a solution of the equation ${\displaystyle x^n=1}$ that is not a solution of the equation ${\displaystyle x^m=1}$ for any positive integer ${\displaystyle m<n}$. If ${\displaystyle a}$ is a ${\displaystyle n}$th primitive root of unity in a field ${\displaystyle F}$, then ${\displaystyle F}$ contains all the ${\displaystyle n}$ roots of unity, which are ${\displaystyle 1,a,a^2,\dots ,a^{n-1}}$.

The field ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ contains a ${\displaystyle n}$th primitive root of unity if and only if ${\displaystyle n}$ is a divisor of ${\displaystyle q-1}$; if ${\displaystyle n}$ is a divisor of ${\displaystyle q-1}$, then the number of primitive ${\displaystyle n}$th roots of unity in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ is ${\displaystyle \varphi (n)}$ (Euler's totient function). The number of ${\displaystyle n}$th roots of unity in ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ is ${\displaystyle \mathrm{g}\mathrm{c}\mathrm{d}(n,q-1)}$.

In a field of characteristic ${\displaystyle p}$, the Frobenius endomorphism ${\displaystyle \phi (x)=x^p}$ is injective. If ${\displaystyle x^{np}=1}$ then ${\displaystyle \phi (x^n)=x^{np}=1=\phi (1)}$ so by injectivity ${\displaystyle x^n=1}$. This show that every ${\displaystyle np}$th root of unity is also a ${\displaystyle n}$th root of unity. It follows that primitive ${\displaystyle np}$th roots of unity never exist in a field of characteristic ${\displaystyle p}$.

On the other hand, if ${\displaystyle n}$ is coprime to ${\displaystyle p}$, the roots of the ${\displaystyle n}$th cyclotomic polynomial are distinct in every field of characteristic ${\displaystyle p}$, as this polynomial is a divisor of ${\displaystyle X^n-1}$, whose discriminant ${\displaystyle n^n}$ is nonzero modulo ${\displaystyle p}$. It follows that the ${\displaystyle n}$th cyclotomic polynomial factors over ${\displaystyle \mathrm{G}\mathrm{F}(q)}$ into distinct irreducible polynomials that have all the same degree, say ${\displaystyle d}$, and that ${\displaystyle \mathrm{G}\mathrm{F}(p^d)}$ is the smallest field of characteristic ${\displaystyle p}$ that contains the ${\displaystyle n}$th primitive roots of unity.

When computing Brauer characters, one uses the map ${\displaystyle {\alpha }^k\mapsto \exp (2\pi ik/(q-1))}$ to map eigenvalues of a representation matrix to the complex numbers. Under this mapping, the base subfield ${\displaystyle \mathrm{G}\mathrm{F}(p)}$ consists of evenly spaced points around the unit circle (omitting zero).

Example: GF(64)

The field GF(64) has several interesting properties that smaller fields do not share: it has two subfields such that neither is contained in the other; not all generators (elements with minimal polynomial of degree 6 over GF(2)) are primitive elements; and the primitive elements are not all conjugate under the Galois group.

The order of this field being 2⁶, and the divisors of 6 being 1, 2, 3, 6, the subfields of GF(64) are GF(2), GF(2²) = GF(4), GF(2³) = GF(8), and GF(64) itself. As 2 and 3 are coprime, the intersection of GF(4) and GF(8) in GF(64) is the prime field GF(2).

The union of GF(4) and GF(8) has thus 10 elements. The remaining 54 elements of GF(64) generate GF(64) in the sense that no other subfield contains any of them. It follows that they are roots of irreducible polynomials of degree 6 over GF(2). This implies that, over GF(2), there are exactly 9 = ⁠54/6⁠ irreducible monic polynomials of degree 6. This may be verified by factoring X⁶⁴ − X over GF(2).

The elements of GF(64) are primitive nth roots of unity for some n dividing 63. As the 3rd and the 7th roots of unity belong to GF(4) and GF(8), respectively, the 54 generators are primitive nth roots of unity for some n in {9, 21, 63}. Euler's totient function shows that there are 6 primitive 9th roots of unity, 12 primitive 21st roots of unity, and 36 primitive 63rd roots of unity. Summing these numbers, one finds again 54 elements.

By factoring the cyclotomic polynomials over ${\displaystyle \mathrm{G}\mathrm{F}(2)}$, one finds that:

• The six primitive ${\displaystyle 9}$th roots of unity are roots of $${\displaystyle X^6+X^3+1,}$$ and are all conjugate under the action of the Galois group.
• The twelve primitive ${\displaystyle 21}$st roots of unity are roots of $${\displaystyle (X^6+X^4+X^2+X+1)(X^6+X^5+X^4+X^2+1).}$$ They form two orbits under the action of the Galois group. As the two factors are reciprocal to each other, a root and its (multiplicative) inverse do not belong to the same orbit.
• The ${\displaystyle 36}$ primitive elements of ${\displaystyle \mathrm{G}\mathrm{F}(64)}$ are the roots of $${\displaystyle \begin{array}{cc}& (X^6+X^4+X^3+X+1)(X^6+X+1)(X^6+X^5+1)\cdot \\ & (X^6+X^5+X^3+X^2+1)(X^6+X^5+X^2+X+1)(X^6+X^5+X^4+X+1).\end{array}}$$ They split into six orbits of six elements each under the action of the Galois group.

This shows that the best choice to construct ${\displaystyle \mathrm{G}\mathrm{F}(64)}$ is to define it as GF(2)[X] / (X⁶ + X + 1). In fact, this generator is a primitive element, and this polynomial is the irreducible polynomial that produces the easiest Euclidean division.

Frobenius automorphism and Galois theory

In this section, ${\displaystyle p}$ is a prime number, and ${\displaystyle q=p^n}$ is a power of ${\displaystyle p}$.

In ${\displaystyle \mathrm{G}\mathrm{F}(q)}$, the identity (x + y)^p = x^p + y^p implies that the map $${\displaystyle \phi :x\mapsto x^p}$$ is a ${\displaystyle \mathrm{G}\mathrm{F}(p)}$-linear endomorphism and a field automorphism of ${\displaystyle \mathrm{G}\mathrm{F}(q)}$, which fixes every element of the subfield ${\displaystyle \mathrm{G}\mathrm{F}(p)}$. It is called the Frobenius automorphism, after Ferdinand Georg Frobenius.

Denoting by φ^k the composition of φ with itself k times, we have $${\displaystyle {\phi }^k:x\mapsto x^{p^k}.}$$ It has been shown in the preceding section that φⁿ is the identity. For 0 < k < n, the automorphism φ^k is not the identity, as, otherwise, the polynomial $${\displaystyle X^{p^k}-X}$$ would have more than p^k roots.

There are no other GF(p)-automorphisms of GF(q). In other words, GF(pⁿ) has exactly n GF(p)-automorphisms, which are $${\displaystyle \mathrm{I}\mathrm{d}={\phi }^0,\phi ,{\phi }^2,\dots ,{\phi }^{n-1}.}$$

In terms of Galois theory, this means that GF(pⁿ) is a Galois extension of GF(p), which has a cyclic Galois group.

The fact that the Frobenius map is surjective implies that every finite field is perfect.

Polynomial factorization

If F is a finite field, a non-constant monic polynomial with coefficients in F is irreducible over F, if it is not the product of two non-constant monic polynomials, with coefficients in F.

As every polynomial ring over a field is a unique factorization domain, every monic polynomial over a finite field may be factored in a unique way (up to the order of the factors) into a product of irreducible monic polynomials.

There are efficient algorithms for testing polynomial irreducibility and factoring polynomials over finite fields. They are a key step for factoring polynomials over the integers or the rational numbers. At least for this reason, every computer algebra system has functions for factoring polynomials over finite fields, or, at least, over finite prime fields.

Irreducible polynomials of a given degree

The polynomial $${\displaystyle X^q-X}$$ factors into linear factors over a field of order q. More precisely, this polynomial is the product of all monic polynomials of degree one over a field of order q.

This implies that, if q = pⁿ then X^q − X is the product of all monic irreducible polynomials over GF(p), whose degree divides n. In fact, if P is an irreducible factor over GF(p) of X^q − X, its degree divides n, as its splitting field is contained in GF(pⁿ). Conversely, if P is an irreducible monic polynomial over GF(p) of degree d dividing n, it defines a field extension of degree d, which is contained in GF(pⁿ), and all roots of P belong to GF(pⁿ), and are roots of X^q − X; thus P divides X^q − X. As X^q − X does not have any multiple factor, it is thus the product of all the irreducible monic polynomials that divide it.

This property is used to compute the product of the irreducible factors of each degree of polynomials over GF(p); see Distinct degree factorization.

Number of monic irreducible polynomials of a given degree over a finite field

The number N(q, n) of monic irreducible polynomials of degree n over GF(q) is given by $${\displaystyle N(q,n)=\frac{1}{n}\sum _{d\mid n}\mu (d)q^{n/d},}$$ where μ is the Möbius function. This formula is an immediate consequence of the property of X^q − X above and the Möbius inversion formula.

By the above formula, the number of irreducible (not necessarily monic) polynomials of degree n over GF(q) is (q − 1)N(q, n).

The exact formula implies the inequality $${\displaystyle N(q,n)\ge \frac{1}{n}(q^n-\sum _{\ell \mid n,\ell \text{ prime}}{q}^{n/\ell });}$$ this is sharp if and only if n is a power of some prime. For every q and every n, the right hand side is positive, so there is at least one irreducible polynomial of degree n over GF(q).

Algebraic closure

A finite field ${\displaystyle F}$ is not algebraically closed: the polynomial $${\displaystyle f(T)=1+\prod _{\alpha \in F}(T-\alpha ),}$$ has no roots in ${\displaystyle F}$, since f (α) = 1 for all ${\displaystyle \alpha }$ in ${\displaystyle F}$.

Given a prime number p, let ${\displaystyle {\overline{\mathbb{F}}}_p}$ be an algebraic closure of ${\displaystyle {\mathbb{F}}_p}$. It is unique up to isomorphism, as holds for an algebraic closure of any given field. Conway polynomials can be used to construct an explicit algebraic closure of ${\displaystyle {\mathbb{F}}_p}$.

For ${\displaystyle n\ge 1}$, let ${\displaystyle {\mathbb{F}}_{p^n}}$ be the set of roots of ${\displaystyle x^{p^n}-x}$ in ${\displaystyle {\overline{\mathbb{F}}}_p}$; it is the unique degree n extension of ${\displaystyle {\mathbb{F}}_p}$ contained in ${\displaystyle {\overline{\mathbb{F}}}_p}$. Any finite field of characteristic p is isomorphic to ${\displaystyle {\mathbb{F}}_{p^n}}$ for some ${\displaystyle n\ge 1}$.

Any algebraic extension is the union of its finite subextensions, so $${\displaystyle {\overline{\mathbb{F}}}_p=\bigcup _{n\ge 1}{\mathbb{F}}_{p^n}.}$$ One has ${\displaystyle {\mathbb{F}}_{p^m}\subseteq {\mathbb{F}}_{p^n}}$ if and only if ${\displaystyle m|n}$, so this union may also be viewed as a direct limit of fields indexed by the set of positive integers partially ordered by divisibility.

An algebraic closure of a field serves also as an algebraic closure of any finite subextension, so ${\displaystyle {\overline{\mathbb{F}}}_p}$ is also an algebraic closure of ${\displaystyle {\mathbb{F}}_{p^n}}$ for each ${\displaystyle n\ge 1}$. The extension ${\displaystyle {\mathbb{F}}_{p^n}/{\mathbb{F}}_p}$ is normal (even Galois, even cyclic), so it is preserved by any element of the Galois group ${\displaystyle \mathrm{Gal}({\overline{\mathbb{F}}}_p/{\mathbb{F}}_p)}$.

Applications

In cryptography, the difficulty of the discrete logarithm problem in a finite field or in an elliptic curve over a finite field is the basis of several widely used protocols, such as the Diffie–Hellman protocol. For example, in 2014, a secure internet connection to Wikipedia involved the elliptic curve Diffie–Hellman protocol (ECDHE) over a large finite field. In coding theory, many codes are constructed as subspaces of vector spaces over finite fields.

Finite fields are used by many error correction codes, such as Reed–Solomon error correction code or BCH code. The finite field almost always has characteristic of 2, since computer data is stored in binary. For example, a byte of data can be interpreted as an element of GF(2⁸). One exception is PDF417 bar code, which is GF(929). Some CPUs have special instructions that can be useful for finite fields of characteristic 2, generally variations of carry-less product.

Finite fields are widely used in number theory, as many problems over the integers may be solved by reducing them modulo one or several prime numbers. For example, the fastest known algorithms for polynomial factorization and linear algebra over the field of rational numbers proceed by reduction modulo one or several primes, and then reconstruction of the solution by using Chinese remainder theorem, Hensel lifting or the LLL algorithm.

Similarly many theoretical problems in number theory can be solved by considering their reductions modulo some or all prime numbers. See, for example, Hasse principle. Many recent developments of algebraic geometry were motivated by the need to enlarge the power of these modular methods. Wiles' proof of Fermat's Last Theorem is an example of a deep result involving many mathematical tools, including finite fields.

The Weil conjectures concern the number of points on algebraic varieties over finite fields and the theory has many applications including exponential and character sum estimates.

Finite fields have widespread application in combinatorics, two well known examples being the definition of Paley Graphs and the related construction for Hadamard Matrices. In arithmetic combinatorics finite fields and finite field models are used extensively, such as in Szemerédi's theorem on arithmetic progressions.

Generalizations

If one weakens the field axioms by dropping commutativity of multiplication, and even relaxing associativity to alternativity, one gets no new finite structures:

• Wedderburn's little theorem states that all finite division rings are commutative, and hence are finite fields.
• The Artin–Zorn theorem states that all alternative division rings are finite fields.