Number Theory III
Michaelmas 2026

Note that by definition, \(x\neq 0\) and \(x\) is not a unit. Assume that \(x=ab\) with \(a,b\in R\). We need to show that either \(a\) or \(b\) is a unit. By definition of \(x\) being prime, \(x\mid a\) or \(x\mid b\). Without loss of generality, assume \(x\mid a\). Then \(a=rx\), for some \(r\in R\) and so \[ x=rxb=xrb. \] Since \(R\) is an integral domain and \(x\neq 0\), we get \(rb=1\), so \(b\) is a unit. □

(1) Certainly \(\pm 1\) are units. Conversely, if \(x\) is a unit, then \(xy=1\) for some \(y\in \Z [\sqrt {-5}]\), so \(N(x)N(y)=N(1)=1\). As \(N(x)\) and \(N(y)\) are non-negative integers, \(N(x)=1\). If \(x=a+b\sqrt {-5}\) with \(a^{2}+5b^{2}=1\), then we must have \(b=0\) and \(a=\pm 1\), so \(x=\pm 1\).

(2) If \(b\neq 0\), then \(a^{2}+5b^{2}\geq 5\). If \(b=0\), then \(a^{2}+5b^{2}=a^{2}\), and neither \(2\) nor \(3\) is a square. □

We have \[ N(2)=4,\quad N(3)=9,\quad N(1+\sqrt {-5})=N(1-\sqrt {-5})=6. \] Let \(x\) be one of the four elements, so that \(N(x)\in \{4,6,9\}\). Then \(x\) is not a unit, by Lemma 0.5 (1), since \(N(x)\neq 1\). Suppose that \(x=yz\) with \(y,z\in \Z [\sqrt {-5}]\). Then \[ N(x)=N(y)N(z), \] so \(N(y)\) is a positive divisor of \(N(x)\). If neither \(y\) nor \(z\) is a unit then \(1 < N(y) < N(x)\), by Lemma 0.5 (1). As \(N(x) \in \{4, 6, 9\}\), this is only possible if \(N(y) = 2\) or 3. But this is not possible, by Lemma 0.5 (2), so either \(y\) or \(z\) is a unit. Thus \(x\) is irreducible.

Since the only units are \(\pm 1\), it is clear that none of the four elements is a unit times another. □

1: If \(I\) is prime and \(\overline {ab}=\overline {0}\) in \(R/I\), then \(ab\in I\), so either \(a\in I\) or \(b\in I\). Thus either \(\overline {a}=\overline {0}\) or \(\overline {b}=\overline {0}\), so \(R/I\) is an integral domain. If \(R/I\) is an integral domain and \(ab\in I\), then \(\overline {ab}=\overline {0}\), and so either \(\overline {a}=\overline {0}\) or \(\overline {b}=\overline {0}\), that is, either \(a\in I\) or \(b\in I\).

2: Assume \(I\) is maximal. Any non-zero element in \(R/I\) has a representative \(x\in R\) such that \(x\not \in I\). Then \((I,x)=R=(1)\), so there is a \(y\in R\) and \(m\in I\) such that \[ xy+m=1. \] This means that \(\overline {xy}=\overline {1}\), so \(\overline {x}\) has an inverse in \(R/I\). Thus \(R/I\) is a field. Conversely, if \(R/I\) is a field and \(x\in R\) such that \(x\notin I\), then there is a \(\overline {y}\in R/I\) such that \(\overline {xy}=\overline {1}\), that is \(xy=1+m\), for some \(m\in I\). Then \[ (x,I)\supset (1+m,I)\supset (1)=R, \] so \((x,I)=R\), and hence \(I\) is maximal. □

Suppose that \(I\) is maximal. By Proposition 0.9 (2), \(R/I\) is a field. Every field is an integral domain and so \(I\) is prime, by Proposition 0.9 (1). □

Suppose some ideal \(I\) of \(R\) contains \((a)\). Then \(I=(t)\) for some \(t\in R\) (as \(R\) is a PID) and so \(a=tm\) for some \(m\in R\) (“to contain is to divide”). Then either \(t\) or \(m\) is a unit (as \(a\) is irreducible). If \(t\) is, then \((t)=(1)=R\) and if \(m\) is, then \((t)=(a)\). Thus either \(I=R\) or \(I=(a)\), that is, \((a)\) is maximal. □

By the above, we already know that \(F[x]/(f(x))\) is a field. It is a vector space over \(F\), because it is an abelian group with scalar multiplication given by \(\alpha \cdot (\overline {g(x)})=\overline {\alpha g(x)}\), for \(\alpha \in F\), \(g(x)\in F[x]\).

The set \(B\) spans \(F[x]/(f(x))\): By long division, any \(g(x)\in F[x]\) can be written \[ g(x)=q(x)f(x)+r(x),\quad \deg r<n, \] so \(\overline {g(x)}=\overline {r(x)}\) (i.e., \(g(x)\equiv r(x)\bmod {(f(x))}\)). Since the span of \(B\) contains any polynomial in \(\overline {x}\) of degree at most \(n-1\), it will contain \(\overline {r(x)}\), hence \(\overline {g(x)}\).

The set \(B\) is linearly independent: If \[ \sum ^{n-1}_{i=0}a_{i}\overline {x}^{i}=\overline {0}, \] for some \(a_{i}\in F\), then \(\sum ^{n-1}_{i=0}a_{i}x^{i}\in (f(x))\), so \(f(x)\) divides \(\sum ^{n-1}_{i=0}a_{i}x^{i}\), hence \(\deg f=n\leq n-1\). This is a contradiction, unless \(a_0 = a_{1}=\cdots =a_{n-1}=0\).

Thus \(B\) is a basis. □

Let \(m\) be the smallest natural number such that \(m\cdot g(x) \in \Z [x]\) and let \(n\) be the smallest natural number such that \(n \cdot h(x) \in \Z [x]\). Write \begin{align*} mg(x) &= a_rx^r + a_{r-1}x^{r-1} + \ldots + a_0 \\ nh(x) &= b_sx^s + b_{s-1}x^{s-1} + \ldots + b_0 \end{align*}

with \(r, s \ge 0\) and \(a_0, \ldots , a_r\) and \(b_0, \ldots , b_s\) integers. Note that \(a_r = m\) and \(b_s = n\). Let \(p\) be a prime dividing \(mn\). Then each of \(m\cdot g(x)\) and \(n \cdot h(x)\) has a coefficient that is not divisible by \(p\), otherwise \(m\) or \(n\) would not have been minimal, but all of the coefficients of their product \[(m\cdot g(x))(n\cdot h(x)) = mnf(x)\] are divisible by \(p\).

It follows that in \(\F _p[x]\) we have an equation \[\left (\bar {a}_rx^r + \ldots + \bar {a}_0\right )\left (\bar {b}_sx^s + \ldots + \bar {b}_0\right ) = 0\] but that both factors on the left hand side are nonzero. This is impossible, as \(\F _p[x]\) is an integral domain. Therefore there are no primes dividing \(mn\), so that \(m = n = 1\) and \(g(x), h(x) \in \Z [x]\) as required. □

\(\Leftarrow \): This was proved in Algebra II.

\(\Rightarrow \): Assume that \(f(x)\) is irreducible in \(\Z [x]\), and suppose for a contradiction that \(f(x)=g(x)h(x)\) with \(g(x),h(x)\in \Q [x]\) and \(\deg g,\deg h\geq 1\). Rescaling, we may assume that \(g\) and \(h\) are monic. By Theorem 0.14, they lie in \(\Z [x]\). Neither is a unit in \(\Z [x]\), as both have degree at least \(1\), so this is a proper factorisation in \(\Z [x]\), contradicting irreducibility. □

We have the following equivalent reformulations of the desired conclusion: \[ a^{p-1}\equiv 1\mod p\iff a^{p-1}-1\in p\Z \iff \bar {a}^{p-1}=\bar {1}\text { in }\F _p^{\times }. \] As \(\F _p\) is a field, \(\F _p^{\times }=\F _p\setminus \{\bar {0}\}\) is a group of order \(p-1\), and the condition \(p\nmid a\) ensures that \(\bar {a}\in \F _p^{\times }\). By Corollary 0.17, \(\bar {a}^{p-1}=\bar {1}\). □

If \(a\) and \(b\) are even, then the triple is not primitive. If \(a\) and \(b\) are both odd, then \(a^2 \equiv b^2 \equiv 1 \bmod 4\). Therefore \[c^2 = a^2 + b^2 \equiv 2 \mod 4.\] As \(2 \mid c^2\), \(2\mid c\). But then \(4 \mid c^2\) and so \(c^2 \equiv 0 \bmod 4\), a contradiction. □

We may factorise \begin{align*} x &= \prod _{i=1}^{k} p_i^{a_i}\\ y &= \prod _{j=1}^{l} q_j^{b_j} \end{align*}

where \(p_1, \ldots , p_k\) are distinct primes, \(q_1, \ldots , q_l\) are distinct primes, and all the exponents \(a_i, b_j\) are positive. As \(x\) and \(y\) are coprime, no \(p_i\) is equal to any \(q_j\), and so \[xy = \prod _{i=1}^{k} p_i^{a_i} \prod _{j=1}^{l} q_j^{b_j}\] is the factorisation of \(xy\) into powers of distinct primes. As \(xy\) is a square, the uniqueness of factorisation in \(\Z \) tells us that every \(a_i\) and every \(b_j\) is even. Therefore \(x\) and \(y\) are squares. □

Suppose that \(a, b, c\) is a primitive triple with \(b\) even. Then \[a^2 = c^2 - b^2 = (c-b)(c+b).\] Note that \begin{align*} \gcd (c-b, c+b) &= \gcd (c-b, 2b) \tag *{(as $c + b = (c-b) + 2b$)} \\ &= \gcd (c-b, b) \tag *{(as $c - b$ is odd)} \\ &= \gcd (c,b) \tag *{(as $c = (c-b) + b$)} \\ &= 1 \tag *{(by Exercise~\ref {ex:pythag-coprime}).} \end{align*}

By Lemma 1.4, there are positive integers \(r\) and \(s\) with \[c + b = r^2, \qquad c - b = s^2.\] Since \(c \pm b\) are odd, \(r\) and \(s\) are both odd, so \[m = \frac {r + s}{2}, \qquad n = \frac {r - s}{2}\] are integers. Then \begin{align*} m^2 + n^2 &= \frac {r^2 + s^2}{2} = c, \\ 2mn &= \frac {r^2 - s^2}{2} = b, \\ m^2 - n^2 &= rs. \end{align*}

As \(a^2 = (c+b)(c-b) = r^2s^2\), we have \(a = rs = m^2 - n^2\) as required.

We leave the final sentence of the theorem as Exercise 1.6. □

The first property of a Euclidean function is straightforward: \[N(xy) = N(x)N(y) \ge N(x)\] if \(x, y \in \Z [i]\) are nonzero, since \(N(a + bi) = a^2 + b^2 \ge 1\) for all \(a, b \in \Z \) not both zero.

For the second property, let \(x, y \in \Z [i]\) be nonzero and let \[\lambda = x/y = a + ib\] with \(a, b \in \Q \). Then the key point is that there exists \(q \in \Z [i]\) with \(N(\lambda - q) < 1\). Indeed, let \(a'\) and \(b'\) be (respectively) the closest integers to \(a\) and \(b\) and set \(q = a' + b'i\). Then \[N(\lambda - q) = |(a' - a) + (b'-b)i|^2 =(a'-a)^2 + (b'-b)^2 \le 1/4 + 1/4 < 1.\] Thus \[N(x - qy) = N(y)N(\lambda - q) < N(y)\] and so \(x = qy + r\) with \(r \in \Z [i]\) and \(N(r) < N(y)\). □

Let \(R\) be an ED with Euclidean function \(\phi \). Let \(I\) be an ideal of \(R\). If \(I=(0)\), then \(I\) is principal, so we can assume without loss of generality that \(I\) is non-zero. Thus, there exists a non-zero \(x\in I\). Assume that \(x\) is chosen to have minimal Euclidean function among all non-zero elements of \(I\), that is, \(\phi (x)\leq \phi (y)\) for all non-zero \(y\in I\). (Note that this is possible, as the values of \(\phi \) are natural numbers or zero). We claim that \(I=(x)\). Indeed, let \(y\in I\). Then there exist \(q,r\in R\) such that \[ y=qx+r, \] where \(r=0\) or \(\phi (r)<\phi (x)\). As \(r = y - qx \in I\), the latter inequality is impossible by our choice of \(x\), so we must have \(r=0\) and hence \(y\in (x)\). □

We already showed in Algebra II that if \(x\) is an irreducible element of a PID then \((x)\) is a maximal ideal (Proposition 0.11). As a maximal ideal is prime (Corollary 0.10), we have that \((x)\) is a prime ideal. It follows that \(x\) is a prime element: certainly \(x\) is nonzero and not a unit (as it is irreducible), and if \(x \mid ab\) then \(ab \in (x)\), so \(a \in (x)\) or \(b \in (x)\) — as \((x)\) is prime — and so \(x \mid a\) or \(x \mid b\) as required. □

Let \(R\) be a PID. We show that any non-zero non-unit in \(R\) is expressible as a product of irreducibles (and hence as a product of primes), and then show that the factorisation is unique.

Suppose that there is a non-zero non-unit \(a\in R\) that is not the product of irreducibles. Then \(a\) is not irreducible (that is, not the product of one irreducible), so \[ a=bc \] for some non-units \(b,c\in R\). At least one of \(b\) or \(c\) cannot be the product of irreducibles, as otherwise \(a=bc\) would be. Thus \(a\) has a proper factor, say \(a_{1}\), that is not the product of irreducibles and we have an inclusion \[ (a)\subsetneq (a_{1}), \] which is strict (not an equality) as otherwise \(a\) would be a unit times \(a_{1}\), so \(a_{1}\) would not be a proper factor of \(a\). Continuing this argument, we obtain¹ an infinite chain of ideals with strict inclusions \[ (a)\subsetneq (a_{1})\subsetneq (a_{2})\subsetneq \cdots . \] But then the union \(\bigcup _{i=1}^\infty (a_i)\) is also an ideal of \(R\) and so is principal, of the form \((a_\infty )\). Then \(a_\infty \in (a_n)\) for some \(n \in \N \) and so \((a_\infty ) \subset (a_i) \subset (a_\infty )\) for all \(i \ge n\). But then \((a_n) = (a_{n+1}) = \ldots \) contradicting that the inclusions above are strict. Thus every non-zero non-unit in \(R\) must be the product of irreducibles.

Uniqueness: (This is the same argument as for \(\Z \) or \(F[x]\) in Algebra II.) Suppose that \[ a=p_{1}p_{2}\cdots p_{n}=q_{1}q_{2}\cdots q_{m}, \] where \(p_{i}\) and \(q_{j}\) are irreducible. By Lemma 2.9, the factors are prime; thus \(p_{1}\mid q_{1}\cdots q_{m}\), so \(p_{1}\) must divide some \(q_{j}\). Reordering if necessary, we can assume that \(j=1\). Then \(p_{1}=u_{1}q_{1}\), for some unit \(u_{1}\in R\) (as \(q_{1}\) is irreducible and \(p_{1}\) is not a unit). Cancelling the factor \(q_{1}\), we get \[ u_{1}p_{2}\cdots p_{n}=q_{2}\cdots q_{m}, \] and continuing this process finitely many times, we obtain:

• if \(n<m\): \(u_{1}\cdots u_{n}=q_{n+1}\cdots q_{m}\); contradiction, as this implies that \(q_{n+1}\) is a unit (while it is irreducible);
• if \(n>m\): \((u_{1}\cdots u_{m})p_{m+1}\cdots p_{n}=1\); contradiction (as before).

Thus \(n=m\) and every \(p_{i}\) on the left-hand side equals some \(q_{j}\) on the right-hand side, up to a unit, proving the uniqueness statement. □

The first part is Exercise 2.5 (1) and Theorems 2.6 and 2.10. The second part is straightforward: if \(x = a + b\sqrt {-2}\) is a unit, then \(xy = 1\) for some \(y \in \Z [\sqrt {-2}]\) and so \(N(x)N(y) = 1\). As \(N(y) \in \N \), \(N(x) = a^2 + 2b^2 = 1\), which is only possible if \(a = \pm 1\) and \(b = 0\). □

We rewrite the equation as \[y^2 + 2 = x^3\] and then factorise the left-hand side: \[(y + \sqrt {-2})(y - \sqrt {-2}) = x^3.\] We will show that \(y + \sqrt {-2}\) and \(y - \sqrt {-2}\) have no irreducible common factors. Indeed, if \(\pi \) is irreducible and \(\pi \) divides both terms, then \(\pi \) divides their difference \(2\sqrt {-2} = -(\sqrt {-2})^3\). Thus \(\pi = \pm \sqrt {-2}\), as this is irreducible (why?) and \(\Z [\sqrt {-2}]\) is a UFD. But then \(-\pi ^2 = 2 \mid x^3\) in \(\Z [\sqrt {-2}]\), which implies that \(x^3\) is even (why?) and so \(x\) is even. Thus \(y^2 = x^3 - 2\) is even and so \(y\) is even. But then \(y^2 + 2\) is \(2 \bmod 4\) and \(x^3\) is \(0 \bmod 4\), contradiction.

As \(\Z [\sqrt {-2}]\) is a UFD and its units are \(\pm 1\), we may write \[y + \sqrt {-2} = \pm \prod _{i=1}^r \pi _i^{e_i}\] with \(\pi _i\) irreducible elements, \(e_i \in \N \), and \(\pi _i \ne \pm \pi _j\) for \(i \ne j\). Applying complex conjugation to both sides we obtain \[y - \sqrt {-2} = \pm \prod _{i=1}^r \bar {\pi }_i^{e_i}\] and, since they have no common factors, we have \(\pi _i \ne \pm \bar {\pi }_j\) for all \(i, j\). Their product then has factorisation \[\prod _{i=1}^r \pi _i^{e_i}\bar {\pi }_i^{e_i}.\] Considering the factorisation of \(x\) we see that all exponents in the factorisation of \(x^3\) are divisible by 3, and so \(3 \mid e_i\) for all \(i\). In particular, each factor \(\pi _i^{e_i}\) is a perfect cube, as is the sign \(\pm 1 = (\pm 1)^3\), and so \(y + \sqrt {-2}\) is itself a perfect cube: \[y + \sqrt {-2} = (a + b\sqrt {-2})^3\] for some \(a, b \in \Z \). Comparing coefficients, we obtain \begin{align*} y &= a^3 - 6ab^2 = a(a^2 - 6b^2) \\ 1 &= 3a^2 b - 2b^3 = b(3a^2 - 2b^2). \end{align*}

From the second of these, we see that \(b = 1\) and \(3a^2 - 2 = 1\), or \(b = -1\) and \(3a^2 - 2 = -1\). The first case gives \(a = \pm 1\) and so \(y = \pm 5\), so \(x = 3\), while the second case does not lead to a solution. Thus \(x = 3, y = \pm 5\) is the only solution in integers to the original equation. □

We show that (3) implies (2) implies (1) implies (4) implies (3).

(3) implies (2): Suppose that we can solve \(x^2 \equiv -1 \bmod p\). Then we have \[p \mid x^2 + 1 = (x + i)(x - i).\] As \((x \pm i)/p \not \in \Z [i]\), \[p \nmid x \pm i.\] Therefore \(p\) is not a prime element. As \(\Z [i]\) is a PID (Lemma 2.3 and Theorem 2.6), this means that \(p\) is reducible, by Lemma 2.9.

(2) implies (1): Suppose that \(p\) is reducible, so that \(p = \pi \pi '\) with neither \(\pi \) nor \(\pi '\) a unit. The units of \(\Z [i]\) are exactly the elements of norm \(1\) (Exercise 3.2), so \(N(\pi ), N(\pi ') \neq 1\). As \(N(\pi )N(\pi ') = N(p) = p^2\), we must have \(N(\pi ) = p\) and so \(p = a^2 + b^2\).

(1) implies (4): Suppose that \(p = a^2 + b^2\). Certainly \(a^2 + b^2 \equiv 0 \bmod p\). Moreover \(p \nmid a, b\): if \(p \mid a\) then \(p \mid b^2\) and so \(p \mid b\), but then \(p^2 \mid a^2 + b^2 = p\).

(4) implies (3): Suppose that \(a^2 + b^2 \equiv 0 \bmod p\) with \(a, b \not \equiv 0 \bmod p\). Then the residue classes \(\bar {a}\) and \(\bar {b}\) are invertible in \(\F _p\), and we obtain \((\bar {a} \bar {b}^{-1})^2 + \bar {1} = 0\) and so \(x^2 \equiv -1 \bmod p\) for any integer \(x\) with \(\bar {x} = \bar {a}\bar {b}^{-1}\). □

The case \(p = 2\) is clear, so suppose that \(p\) is odd and that \(x^2 \equiv -1 \bmod p\) has a solution. Then we raise both sides to the power \(\frac {p-1}{2}\): \[x^{p-1} \equiv (x^2)^{\frac {p-1}{2}} \equiv (-1)^{\frac {p-1}{2}}.\] As \(x^2 \equiv -1 \bmod p\), we have \(p \nmid x\), so by Fermat’s little theorem (Theorem 0.18) the left-hand side is \(1 \bmod p\). The right-hand side is \(1\bmod p\) if \(p \equiv 1 \bmod 4\) and \(-1 \bmod p\) if \(p \equiv 3 \bmod 4\). Since \(p\) is odd, \(1 \not \equiv -1 \bmod p\) and so we deduce that \(p \equiv 1 \bmod 4\).

Now suppose that \(p \equiv 1 \bmod 4\). Consider the polynomial \[f(x) = x^{p-1} - \bar {1} \in \F _p[x].\] By Fermat’s little theorem, it has \(\pm \bar {j}\) as roots for \(j = 1, \ldots , \frac {p-1}{2}\). By the factor theorem and the fact that \(\F _p[x]\) is a UFD, \[\prod _{j=1}^{\frac {p-1}{2}} (x + \bar {j})(x - \bar {j}) \mid x^{p-1} - \bar {1}\] and as both sides are monic of the same degree, \[\prod _{j=1}^{\frac {p-1}{2}} (x + \bar {j})(x - \bar {j}) = x^{p-1} - \bar {1}.\] Comparing constant terms, we see that \[(-1)^{(p-1)/2}\left (\left (\frac {p-1}{2}\right )!\right )^2 \equiv -1 \mod p.\] As \(p \equiv 1 \bmod 4\), the initial sign is \(+1\) and so \(x = \left (\frac {p-1}{2}\right )!\) is a solution to \(x^2 \equiv -1 \bmod p\). □

This follows from Proposition 3.3 and Lemma 3.4. □

Suppose that \(p = a^2 + b^2 = c^2 + d^2\). Then \[(a+ bi)(a - bi) = (c + di)(c - di)\] and all four brackets have prime norm \(p\) and are hence irreducible. By unique factorisation in \(\Z [i]\), \[a + bi = u(c \pm di)\] for some unit \(u \in \Z [i]\). As the only units are \(\pm 1\) and \(\pm i\) (Exercise 3.2), we obtain \[a = \pm c, b = \pm d\] or \[a = \pm d, b = \pm c\] as required. □

Let \(\alpha \in L\). The elements \(1,\alpha ,\alpha ^{2},\dots ,\alpha ^{[L:F]}\) must be linearly dependent, as there are \([L:F]+1\) of them and \(\dim _{F}L=[L:F]\). This means that there are some \(a_{i}\in F\), not all zero, and \(n\geq 0\) such that \(\sum ^{n}_{i=0}a_{i}\alpha ^{i}=0\), that is, \(\alpha \) is a root of the non-zero polynomial \(f(x)=\sum ^{n}_{i=0}a_{i}x^{i}\). We have shown that an arbitrary \(\alpha \in L\) is algebraic; thus \(L/F\) is algebraic. □

(1) implies (2): suppose that \(f(x)\) is the minimal polynomial of \(\alpha \) over \(F\) and that it is reducible. Then \(f(x) = g(x)h(x)\) with \(g(x)\) and \(h(x)\) monic polynomials and \(\deg g, \deg h < \deg f\). As \(f(\alpha ) = 0\), either \(g(\alpha ) = 0\) or \(h(\alpha ) = 0\). Either way, this contradicts the minimality of \(\deg f\).

(2) implies (3): Suppose that \(f(x)\) is irreducible. As \(F[x]\) is a PID, \(I_\alpha = (g(x))\) for some polynomial \(g(x)\) that we may take to be monic. As \(f(\alpha ) = 0\), \(f(x) \in I_\alpha \), and so \(f(x) = g(x)h(x)\) for some \(h(x) \in F[x]\). But \(f(x)\) is irreducible, and \(g(x)\) is nonconstant as \(g(\alpha ) = 0\), so \(h(x) = 1\) and \(f(x) = g(x)\).

(3) implies (1): Suppose that \(I_\alpha = (f(x))\) and that \(g(x)\) is another monic polynomial with \(g(\alpha ) = 0\). Then \(g(x) \in I_\alpha \) and so \(g(x) = f(x) h(x) \) for some (nonzero) \(h(x) \in F[x]\). Thus \(\deg g \ge \deg f\), so \(\deg f\) is minimal among monic polynomials with \(\alpha \) as a root. □

(1). It is clear that \(\ev _\alpha \) is a surjective \(F\)-linear ring homomorphism (for example, \(f(x) + g(x)\) is sent to \(f(\alpha ) + g(\alpha )\), so it is additive). The kernel is \[\{f(x) \in F[x] : f(\alpha ) = 0\}\] which we have already shown (Proposition 4.9) is generated by \(p_\alpha (x)\).

(2). Since \(p_\alpha (x)\) is irreducible and \(F[x]\) is a PID, \((p_\alpha (x))\) is maximal and so \(F[x]/(p_\alpha (x))\) is a field. By the isomorphism theorem for ring homomorphisms, \[F[\alpha ] \cong F[x]/\ker (\ev _\alpha ) = F[x]/(p_\alpha (x)).\] Thus \(F[\alpha ]\) is a field, and so \(F[\alpha ] = F(\alpha )\). □

Let \(d = \deg p_\alpha \). We show that \(\{1, \alpha , \ldots , \alpha ^{d-1}\}\) is a basis of \(F(\alpha )\) over \(F\).

It spans: by Lemma 4.11, \(F(\alpha ) = F[\alpha ]\), so every element of \(F(\alpha )\) is of the form \(f(\alpha )\) for some \(f(x) \in F[x]\). By Euclid we may write \(f(x) = q(x)p_\alpha (x) + r(x)\) with \(\deg r < d\). Then \(f(\alpha ) = r(\alpha )\), which is in the span of \(\{1, \alpha , \ldots , \alpha ^{d-1}\}\).

It is linearly independent: if \(\sum _{i=0}^{d-1} a_i \alpha ^i = 0\), then \(\alpha \) is a root of \(\sum _{i=0}^{d-1} a_i x^i\), a polynomial of degree less than \(d\). By the minimality of \(\deg p_\alpha \), this polynomial is zero, that is, \(a_i = 0\) for all \(i\). □

We treat the case where \([L:K]\) and \([K:F]\) are finite; the infinite cases are similar. Let \(\{e_{1},\dots ,e_{m}\}\) be a \(K\)-basis of \(L\), where \(m=[L:K]\) and \(\{f_{1},\dots ,f_{d}\}\) an \(F\)-basis of \(K\), where \(d=[K:F]\). We claim that the \(md\) elements \(e_{i}f_{j}\), for \(1\leq i\leq m\) and \(1\leq j\leq d\), form an \(F\)-basis of \(L\).

For any \(\alpha \in L\), we can write \[ \alpha =\sum ^{m}_{i=1}a_{i}e_{i},\qquad a_{i}\in K. \] Moreover, for each \(a_{i}\), we can write \(a_{i}=\sum ^{d}_{j=1}b_{ij}f_{j}\), for some \(b_{ij}\in F\), so that \[ \alpha =\sum ^{m}_{i=1}\sum ^{d}_{j=1}b_{ij}f_{j}e_{i}. \] Thus the \(e_{i}f_{j}\) span \(L\) over \(F\). To show that they are linearly independent, suppose that \[ \sum ^{m}_{i=1}\sum ^{d}_{j=1}c_{ij}e_{i}f_{j}=0, \] for some \(c_{ij}\in F\). Then, as the \(e_{i}\) are linearly independent over \(K\), we must have \[ \sum ^{d}_{j=1}c_{ij}f_{j}=0\qquad \text {for all }i=1,\dots ,m. \] But as the \(f_{j}\) are linearly independent over \(F\), this implies that \(c_{ij}=0\) for all \(i\) and \(j\). □

To show that \(\alpha \mapsto \hat {\alpha }\) is an \(F\)-linear ring homomorphism, we must check that, for \(\alpha ,\beta \in L\) and \(c\in F\):

1. \(\hat {1}=\Id _{L}\);
2. \(\widehat {\alpha +\beta }=\hat {\alpha }+\hat {\beta }\);
3. \(\widehat {c\alpha }=c\hat {\alpha }\);
4. \(\widehat {\alpha \beta }=\hat {\alpha }\circ \hat {\beta }\).

This is straightforward: for example, \[\widehat {(\alpha + \beta )}(x) = (\alpha + \beta )x = \alpha x + \beta x = \widehat {\alpha }(x) + \widehat {\beta }(x).\]

Finally, the kernel of the map is \((0)\): if \(\hat {\alpha }=0\) then \(\alpha =\hat {\alpha }(1)=0\). Therefore it is injective. □

1. The map \(\hat {\alpha }\), and hence the matrix \(T_{\alpha }\), is invertible if \(\alpha \neq 0\) (as the inverse is then \(\widehat {\alpha ^{-1}}\)). Thus \(\det (T_{\alpha })=0\) if and only if \(\alpha =0\).
2. Follows from \(T_{\alpha \beta }=T_{\alpha }T_{\beta }\) and the multiplicativity of the determinant.
3. For \(a\in F\), we have \(T_{a}=aI\), where \(I\) is the identity matrix of size \([L:F]\).
4. Follows from \(T_{a\alpha +b\beta }=aT_{\alpha }+bT_{\beta }\) and the fact that the trace of a matrix is the sum of the diagonal entries.

□

Write \(f(x)=a_{0}+a_{1}x+\dots +a_{k}x^{k}\) with \(a_{i}\in F\). As \(\alpha \mapsto T_{\alpha }\) is an \(F\)-linear ring homomorphism, \[ T_{f(\alpha )}=\sum ^{k}_{i=0}T_{a_{i}\alpha ^{i}}=\sum ^{k}_{i=0}a_{i}T_{\alpha ^{i}}=\sum ^{k}_{i=0}a_{i}T^{i}_{\alpha }=f(T_{\alpha }), \] as required. □

We have already seen that \(\chi _{\alpha }(x)\) is monic of degree \([L:F]\) and \(\chi _{\alpha }(\alpha )=0\). By Lemma 4.12, \[ \deg p_{\alpha }(x)=[L:F]=\deg \chi _{\alpha }, \] so by the uniqueness of the minimal polynomial (Proposition 4.9 (1)), we have \(\chi _{\alpha }(x)=p_{\alpha }(x)\). □

(1) Let \(x_{1},\dots ,x_{d}\) be an \(F\)-basis of \(F(\alpha )\) (for example, the power basis \(1,\alpha ,\dots ,\alpha ^{d-1}\)) and let \(y_{1},\dots ,y_{m}\) be an \(F(\alpha )\)-basis of \(L\). Then, by the proof of the Tower Theorem, an \(F\)-basis of \(L\) is \[ \{x_{1}y_{1},\dots ,x_{d}y_{1},\dots ,x_{1}y_{m},\dots ,x_{d}y_{m}\}. \] Since \(\alpha \in F(\alpha )\), for \(1\leq i,j\leq d\) there are \(c_{ij}\in F\) such that \(\alpha x_{j}=\sum ^{d}_{i=1}c_{ij}x_{i}\); thus \[ T_{\alpha ,F(\alpha )/F}=(c_{ij})_{ij}\in \M _{d}(F). \] Since \(\alpha \cdot x_{j}y_{k}=\sum ^{d}_{i=1}c_{ij}x_{i}y_{k}\) (and the \(x_{i}y_{k}\) form an \(F\)-basis of \(L\)), we have that \(T_{\alpha ,L/F}\) is a block diagonal matrix with \(m\) repeated \(d\times d\) blocks equal to \(T_{\alpha ,F(\alpha )/F}\), that is, \[ T_{\alpha ,L/F}=\begin {pmatrix}T_{\alpha ,F(\alpha )/F} & & 0\\ & \ddots \\ 0 & & T_{\alpha ,F(\alpha )/F} \end {pmatrix}. \] Since the determinant of a block diagonal matrix is the product of the determinants of the blocks, we get \begin{align*} \chi _{\alpha }(x)=\chi _{\alpha ,L/F}(x)&=\det (xI-T_{\alpha ,L/F})=\det (xI-T_{\alpha ,F(\alpha )/F})^{m}\\ &=\chi _{\alpha ,F(\alpha )/F}(x)^{m}=p_{\alpha }(x)^{m}, \end{align*}

where the last equality is by Lemma 4.20.

(2) and (3) The first equalities follow from considering the determinant and trace of the block matrix above. The second equalities then follow from \(N_{F(\alpha )/F}(\alpha )=(-1)^{d}a_{0}\) and \(\Tr _{F(\alpha )/F}(\alpha )=-a_{d-1}\), which hold by Lemma 4.20 and equation (1). □

We can quickly reduce to the case \(L = K(\alpha )\) using Proposition 4.21 (2) and (3). (In fact, Proposition 4.21 parts (2) and (3) follow from Theorem 4.22, but our proof depends on having proved those consequences first.)

So suppose that \(L=K(\alpha )\), let \(n=[K:F]\) and \(d=[L:K]\), and let \[ p_{\alpha ,K}(x)=x^{d}+a_{d-1}x^{d-1}+\dots +a_{0},\qquad a_{i}\in K. \] Let \(\beta _1, \ldots , \beta _n\) be a basis for \(K/F\). By the proof of the Tower Theorem, an \(F\)-basis for \(L\) is \[ \beta _1, \ldots , \beta _n,\ \alpha \beta _1, \ldots , \alpha \beta _n, \ldots ,\alpha ^{d-1}\beta _1, \ldots , \alpha ^{d-1}\beta _n. \] We compute \(T_{\alpha ,L/F}\) in this basis, as a \(d\times d\) matrix of \(n\times n\) blocks. For \(j<d-1\), multiplication by \(\alpha \) sends \(\alpha ^{j}\beta _i\) to \(\alpha ^{j+1}\beta _i\), while \[ \alpha \cdot \alpha ^{d-1}\beta _i=\alpha ^{d}\beta _i=-\sum _{j=0}^{d-1}\alpha ^{j}(a_j\beta _i), \] and the coordinates of \(a_j\beta _i\) with respect to \(\beta _1,\ldots ,\beta _n\) form the \(i\)th column of \(A_j=T_{a_j,K/F}\). Hence \[ T_{\alpha ,L/F}=\begin {pmatrix} 0 & 0 & \cdots & 0 & -A_{0}\\ I & 0 & \cdots & 0 & -A_{1}\\ 0 & I & \cdots & 0 & -A_{2}\\ \vdots & & \ddots & & \vdots \\ 0 & 0 & \cdots & I & -A_{d-1} \end {pmatrix}, \] where \(I\) is the \(n\times n\) identity matrix.

For the trace, only the bottom right block contributes, so \[ \Tr _{L/F}(\alpha )=\Tr (-A_{d-1})=\Tr _{K/F}(-a_{d-1})=\Tr _{K/F}(\Tr _{L/K}(\alpha )), \] as \(\Tr _{L/K}(\alpha )=-a_{d-1}\) by Lemma 4.20 and equation (1).

For the norm, move the last block of \(n\) columns to the front. This permutation of the columns changes the determinant by the sign \((-1)^{n(d-1)}\) and gives a block lower triangular matrix with blocks \(-A_0, I, \ldots , I\) on the diagonal. You can convince yourself that its determinant is the product of the determinants of the blocks on the diagonal and, therefore, \begin{align*} N_{L/F}(\alpha )&=(-1)^{n(d-1)}\det (-A_0)=(-1)^{nd}N_{K/F}(a_0)\\ &=N_{K/F}((-1)^{d}a_0)=N_{K/F}(N_{L/K}(\alpha )), \end{align*}

since \(N_{L/K}(\alpha )=(-1)^{d}a_0\) by Lemma 4.20 and equation (1). □

We first show that if \(F\subset \C \) is a field and \(f(x)\in F[x]\) is irreducible, then the roots of \(f(x)\) in \(\C \) are distinct (for those taking Galois theory: \(F\) is separable). Suppose instead that \(f(x)=(x-a)^{2}g(x)\) for some \(a\in \C \) and \(g(x)\in \C [x]\). Then \[ f'(x)=2(x-a)g(x)+(x-a)^{2}g'(x), \] so \(f'(a)=0\). As \(F[x]\) is a PID, we may write \(h(x)=\gcd (f(x),f'(x))=f(x)u(x)+f'(x)v(x)\) for some \(u(x),v(x)\in F[x]\), and then \(h(a)=0\), so \(h(x)\) is not constant. As \(h(x)\) divides the irreducible polynomial \(f(x)\), it is a constant multiple of \(f(x)\). But \(h(x)\) also divides \(f'(x)\), which is non-zero of degree \(\deg f-1\); contradiction.

Now, \(K=\Q (\theta _{1},\dots ,\theta _{n})\) for finitely many \(\theta _{i}\in K\) (for example, a \(\Q \)-basis of \(K\)). As \(\Q (\theta _{1},\dots ,\theta _{n})=\Q (\theta _{1},\theta _{2})(\theta _{3},\dots ,\theta _{n})\), by induction on \(n\) it is enough to prove the following: if \(F\subset \C \) is a field and \(\alpha ,\beta \in \C \) are algebraic over \(F\), then \(F(\alpha ,\beta )=F(\theta )\) for some \(\theta \).

Let \(\alpha _{1},\dots ,\alpha _{n}\) be the roots of \(p_{\alpha ,F}(x)\) and \(\beta _{1},\dots ,\beta _{m}\) the roots of \(p_{\beta ,F}(x)\), with \(\alpha _{1}=\alpha \) and \(\beta _{1}=\beta \); by the first paragraph, the \(\alpha _{i}\) are distinct and the \(\beta _{k}\) are distinct. Hence for each \(i\) and each \(k\neq 1\) there is at most one \(x\in F\) such that \[ \alpha _{i}+x\beta _{k}=\alpha +x\beta , \] namely \(x=\frac {\alpha _{i}-\alpha }{\beta -\beta _{k}}\). Since there are only finitely many such equations and \(F\) is infinite, we may choose \(c\neq 0\) in \(F\) not equal to any of these \(x\), so that \[ \alpha _{i}+c\beta _{k}\neq \alpha +c\beta \qquad \text {for }1\leq i\leq n,\ 2\leq k\leq m. \] Let \(\theta =\alpha +c\beta \). Clearly \(F(\theta )\subset F(\alpha ,\beta )\). We will show that \(\beta \in F(\theta )\); then also \(\alpha =\theta -c\beta \in F(\theta )\), so that \(F(\theta )=F(\alpha ,\beta )\).

Define the polynomial \[ r(x)=p_{\alpha ,F}(\theta -cx)\in F(\theta )[x], \] which is non-zero as \(c\neq 0\). Then \(r(\beta )=p_{\alpha ,F}(\alpha )=0\), so \(\beta \) is a root of both \(p_{\beta ,F}(x)\) and \(r(x)\). These two polynomials have no other common root in \(\C \): if \(p_{\beta ,F}(\gamma )=r(\gamma )=0\), then \(\gamma =\beta _{k}\) for some \(k\), and \(\theta -c\gamma \) is a root of \(p_{\alpha ,F}(x)\), so \(\theta -c\gamma =\alpha _{i}\) for some \(i\). This gives \(\alpha _{i}+c\beta _{k}=\alpha +c\beta \), which by our choice of \(c\) forces \(k=1\), that is, \(\gamma =\beta \).

Now \(p_{\beta ,F(\theta )}(x)\) divides both \(p_{\beta ,F}(x)\) and \(r(x)\) in \(F(\theta )[x]\), by Proposition 4.9, so its only root in \(\C \) is \(\beta \). As it is irreducible over \(F(\theta )\), its roots are distinct by the first paragraph, so \(p_{\beta ,F(\theta )}(x)=x-\beta \). Thus \(\beta \in F(\theta )\), as required. □

Let \(\alpha ,\beta \in \bar {\Q }\). By Lemma 4.12, \([\Q (\alpha ):\Q ]\) is finite. Since \(\beta \) is algebraic over \(\Q \), it is also algebraic over \(\Q (\alpha )\) and \([\Q (\alpha )(\beta ):\Q (\alpha )]\) is finite. By the Tower Theorem, \(\Q (\alpha ,\beta )=\Q (\alpha )(\beta )\) is a number field. It contains \(\alpha +\beta \), \(-\alpha \), \(\alpha \beta \) and (if \(\alpha \neq 0\)) \(\alpha ^{-1}\), which are therefore algebraic numbers by Proposition 4.7. Thus \(\bar {\Q }\) is a subfield of \(\C \).

Suppose that \([\bar {\Q }:\Q ]=n\) is finite. Then for every \(\alpha \in \bar {\Q }\) the Tower Theorem gives \([\Q (\alpha ):\Q ]\leq n\), so every algebraic number has degree at most \(n\) over \(\Q \) (Lemma 4.12). But \(x^{n+1}-2\) is irreducible over \(\Q \) by Eisenstein’s criterion, so \(\sqrt [n+1]{2}\) is an algebraic number of degree \(n+1\); contradiction. □

By Proposition 4.21 (1), \[ \chi _{\alpha ,K/\Q }(x)=p_{\alpha }(x)^{m}=(x-\alpha _{1})^{m}\cdots (x-\alpha _{d})^{m}, \] so the roots of \(\chi _{\alpha ,K/\Q }(x)\) are the \(\alpha _{i}\), each repeated \(m\) times. The lemma now follows from equation (1). □

(1) implies (2): Let \(f(x)\in \Z [x]\) be monic with \(f(\alpha )=0\). By Proposition 4.9, \(p_{\alpha }(x)\) divides \(f(x)\) in \(\Q [x]\), say \(f(x)=p_{\alpha }(x)h(x)\), and \(h(x)\) is monic as \(f(x)\) and \(p_{\alpha }(x)\) are. By Gauss’s lemma (Theorem 0.14), \(p_{\alpha }(x)\in \Z [x]\).

(2) implies (3): Write \(p_{\alpha }(x)=x^{d}+a_{d-1}x^{d-1}+\dots +a_{0}\) with \(a_{i}\in \Z \). Then \(p_{\alpha }(\alpha )=0\) implies that \[ \alpha ^{d}=-(a_{d-1}\alpha ^{d-1}+\dots +a_{0}), \] so \(\alpha ^{d}\in \Z +\Z \alpha +\dots +\Z \alpha ^{d-1}\). Multiplying by \(\alpha \) and using induction, every power \(\alpha ^{k}\) lies in \(\Z +\Z \alpha +\dots +\Z \alpha ^{d-1}\), and hence so does every \(f(\alpha )\) with \(f(x)\in \Z [x]\).

(3) implies (4): Take \(G=\Z [\alpha ]\), regarded as a group under addition. By (3), \(G\) is finitely generated, by \(1,\alpha ,\dots ,\alpha ^{d-1}\), and \(\alpha G\subset G\) as \(G\) is a ring.

(4) implies (1): Let \(\gamma _{1},\dots ,\gamma _{r}\) generate \(G\); they are not all \(0\), as \(G\neq \{0\}\). As \(\alpha \gamma _{i}\in G\), for each \(i=1,\dots ,r\) we can write \[ \alpha \gamma _{i}=m_{i1}\gamma _{1}+\dots +m_{ir}\gamma _{r},\qquad m_{ij}\in \Z . \] In terms of matrices, writing \(M=(m_{ij})\in \M _{r}(\Z )\), this says \[ \alpha \begin {pmatrix}\gamma _{1}\\ \vdots \\ \gamma _{r} \end {pmatrix}=M\begin {pmatrix}\gamma _{1}\\ \vdots \\ \gamma _{r} \end {pmatrix}. \] Thus \(\alpha \) is an eigenvalue of \(M\), so it is a root of the characteristic polynomial \(\chi _{M}(x)=\det (xI-M)\), which is monic with integer coefficients. Hence \(\alpha \in \bar {\Z }\). □

If \(a\in \Q \) then \(p_{a}(x)=x-a\). By the second criterion of Theorem 5.7, \(a\in \bar {\Z }\) if and only if \(x-a\in \Z [x]\), that is, if and only if \(a\in \Z \). □

The conjugates of \(\alpha \) have the same minimal polynomial, so are also algebraic integers by the second criterion of Theorem 5.7. □

Let \(\alpha ,\beta \in \bar {\Z }\), of degrees \(d_{1}\) and \(d_{2}\) over \(\Q \). We need to show that \(\alpha +\beta \), \(\alpha \beta \) and \(-\alpha \) lie in \(\bar {\Z }\). Consider the ring \[ \Z [\alpha ,\beta ]=\{f(\alpha ,\beta )\mid f(x,y)\in \Z [x,y]\} \] generated by \(\alpha \) and \(\beta \) over \(\Z \). By the argument in the proof that (2) implies (3) in Theorem 5.7, powers \(\alpha ^{i}\) with \(i\geq d_{1}\) can be eliminated, and likewise for \(\beta \), so \[ \Z [\alpha ,\beta ]=\sum _{0\leq i<d_{1},\ 0\leq j<d_{2}}\Z \alpha ^{i}\beta ^{j}. \] Thus \(G=\Z [\alpha ,\beta ]\) is a finitely generated abelian group under addition. As \(G\) is a ring containing \(\alpha \) and \(\beta \), we have \((\alpha +\beta )G\subset G\), \((\alpha \beta )G\subset G\) and \((-\alpha )G\subset G\). By Theorem 5.7 ((4) implies (1)), \(\alpha +\beta \), \(\alpha \beta \) and \(-\alpha \) lie in \(\bar {\Z }\).

Finally, \(\cO _{K}=\bar {\Z }\cap K\) is the intersection of two subrings of \(\C \), so is a ring. □

By Proposition 4.21, \(\chi _{\alpha ,K/\Q }(x)=p_{\alpha }(x)^{m}\) where \(m=[K:\Q (\alpha )]\), and \(p_{\alpha }(x)\in \Z [x]\) by Theorem 5.7. The norm and trace are, up to sign, coefficients of \(\chi _{\alpha ,K/\Q }(x)\), by equation (1). □

Let \(\beta \in K\). It suffices to show that \(m\beta \in \cO _{K}\) for some non-zero \(m\in \Z \). Since \(\beta \) is algebraic over \(\Q \), after clearing denominators we have \[ a_{n}\beta ^{n}+a_{n-1}\beta ^{n-1}+\dots +a_{1}\beta +a_{0}=0, \] for some \(a_{i}\in \Z \) with \(a_{n}\neq 0\). Multiplying by \(a^{n-1}_{n}\), we obtain \[ (a_{n}\beta )^{n}+a_{n-1}(a_{n}\beta )^{n-1}+\dots +a_{1}a^{n-2}_{n}(a_{n}\beta )+a_{0}a^{n-1}_{n}=0. \] Thus \(a_{n}\beta \) is a root of a monic polynomial in \(\Z [x]\), so \(a_{n}\beta \in \bar {\Z }\cap K=\cO _{K}\). □

If \(\alpha \) is a unit, then \(\alpha \beta =1\) for some \(\beta \in \cO _{K}\), so \(N_{K}(\alpha )N_{K}(\beta )=N_{K}(1)=1\). Since \(N_{K}(\alpha ),N_{K}(\beta )\in \Z \) by Lemma 5.11, we have \(N_{K}(\alpha )=\pm 1\).

Conversely, suppose that \(N_{K}(\alpha )=\pm 1\). Let \(\alpha _{1},\dots ,\alpha _{d}\) be the conjugates of \(\alpha \), numbered so that \(\alpha _{1}=\alpha \), and let \(m=[K:\Q (\alpha )]\). By Lemma 5.5, \begin{align*} \pm 1=N_{K}(\alpha ) & =(\alpha _{1}\cdots \alpha _{d})^{m}\\ & =\alpha \beta ,\qquad \text {where }\beta =\alpha ^{m-1}(\alpha _{2}\cdots \alpha _{d})^{m}. \end{align*}

Each \(\alpha _{i}\) lies in \(\bar {\Z }\) by Corollary 5.9, so \(\beta \in \bar {\Z }\) by Proposition 5.10. Also \(\beta =\pm \alpha ^{-1}\in K\). Hence \(\beta \in \cO _{K}\), and \(\alpha ^{-1}=\pm \beta \in \cO _{K}\). Thus \(\alpha \in \cO ^{\times }_{K}\). □

Let \(\alpha \in K\setminus \Q \). Then \([\Q (\alpha ):\Q ]>1\) divides \([K:\Q ]=2\) by the Tower Theorem, so \([\Q (\alpha ):\Q ] = 2\) and \(K=\Q (\alpha )\). Then \(p_{\alpha }(x)=x^{2}+bx+c\) for some \(b,c\in \Q \). Solving the quadratic equation, \(\alpha =\frac {-b\pm \sqrt {D}}{2}\) with \(D=b^{2}-4c\in \Q \), so \(K = \Q (\sqrt {D})\). Choose \(s\in \N \) such that \(s^{2}D\in \Z \), and write \(s^{2}D=t^{2}d\) with \(t\in \N \) and \(d\) squarefree. Then \(\sqrt {D}=\pm \frac {t}{s}\sqrt {d}\), so \(K=\Q (\sqrt {d})\). We have \(d\neq 1\) as \(\sqrt {d}\notin \Q \). The uniqueness of \(d\) is Exercise 5.15. □

Put \(\theta =\frac {1+\sqrt {d}}{2}\). As already noted, \(\theta \) is a root of \(x^{2}-x-\frac {d-1}{4}\in \Z [x]\) and so \(\Z [\theta ]=\Z +\Z \theta \) (see the proof that (2) implies (3) in Theorem 5.7). Now, for \(x,y\in \Z \), \[ x+y\theta =\frac {(2x+y)+y\sqrt {d}}{2}, \] and \(2x+y\equiv y\bmod 2\), which shows that \(\Z [\theta ]\) is contained in the right hand side. Conversely, if \(r,s\in \Z \) and \(r\equiv s\bmod 2\), then \[ \frac {r+s\sqrt {d}}{2}=\frac {r-s}{2}+s\theta \in \Z +\Z \theta =\Z [\theta ], \] so the two sets are equal. □

Let \(\alpha =a+b\sqrt {d}\in K\) with \(a,b\in \Q \). We first claim that \begin{equation} \alpha \in \cO _{K}\quad \text {if and only if}\quad 2a\in \Z \text { and }a^{2}-db^{2}\in \Z . \tag{2}\end{equation} If \(b\neq 0\), then \(\alpha \notin \Q \), so \(K=\Q (\alpha )\) and, by Lemma 4.20 and Example 4.17, \[ p_{\alpha }(x)=\chi _{\alpha }(x)=x^{2}-\Tr _{K}(\alpha )x+N_{K}(\alpha )=x^{2}-2ax+(a^{2}-db^{2}). \] The claim then follows from Theorem 5.7. If \(b=0\), then \(\alpha =a\in \cO _{K}\) if and only if \(a\in \Z \) (as \(\cO _{K}\cap \Q =\cO _{\Q }=\Z \)), which holds if and only if \(2a\in \Z \) and \(a^{2}\in \Z \).

Now put \(r=2a\) and \(s=2b\), so that \(\alpha =\frac {r+s\sqrt {d}}{2}\) and \(4(a^{2}-db^{2})=r^{2}-ds^{2}\). Suppose that \(\alpha \in \cO _{K}\). Then \(r\in \Z \) and \(r^{2}-ds^{2}\in 4\Z \), so \(ds^{2}\in \Z \). Writing \(s=\frac {u}{v}\) in lowest terms with \(v>0\), we see that \(v^{2}\mid du^{2}\) and hence \(v^{2}\mid d\); as \(d\) is squarefree, \(v=1\) and \(s\in \Z \). Conversely, if \(r,s\in \Z \) and \(r^{2}\equiv ds^{2}\bmod 4\), then \(\alpha \in \cO _{K}\) by equation (2). We have shown that \[ \cO _{K}=\Big \{\frac {r+s\sqrt {d}}{2}\;\Big |\;r,s\in \Z ,\ r^{2}\equiv ds^{2}\bmod 4\Big \}. \] Recall that every square is congruent to \(0\) or \(1\) modulo \(4\), and that \(d\not \equiv 0\bmod 4\) as \(d\) is squarefree.

• If \(d\equiv 1\bmod 4\), then \(r^{2}\equiv ds^{2}\bmod 4\) if and only if \(r^{2}\equiv s^{2}\bmod 4\), which holds if and only if \(r\equiv s\bmod 2\). So \(\cO _{K}=\Z [\frac {1+\sqrt {d}}{2}]\) by Lemma 5.17.
• If \(d\equiv 2\) or \(3\bmod 4\) and \(s\) is odd, then \(ds^{2}\equiv d\bmod 4\) is not congruent to a square. So \(s\) is even, and then \(r^{2}\equiv 0\bmod 4\), so \(r\) is even. Conversely, if \(r\) and \(s\) are both even, then \(r^{2}\equiv ds^{2}\equiv 0\bmod 4\). So \(\cO _{K}=\{a+b\sqrt {d}\mid a,b\in \Z \}=\Z [\sqrt {d}]\). □

Firstly, note that if \(x, y \in \F _p^\times \) with \(x^2 = y^2\) then \(x = \pm y\). This follows from \(x^2 - y^2 = (x+y)(x-y)\) and the fact that \(\F _p\) is an integral domain. Since \(p\) is odd, \(y\) and \(-y\) are distinct. Thus every element of \(\F _p^\times \) has either no square roots or exactly two square roots in \(\F _p^\times \). In other words, the function \(x \mapsto x^2\) is two-to-one on \(\F _p^\times \), so its image, the set of quadratic residues, has exactly \(\frac {p-1}{2}\) elements. □

If \(p\mid a\), both sides are \(0\bmod p\), so we may suppose that \(p\nmid a\).

Note that \[\left (a^{\frac {p-1}{2}}\right )^2 = a^{p-1} \equiv 1 \mod p\] by Fermat’s little theorem, and hence (by the argument in Lemma 6.2) \begin{equation}a^{\frac {p-1}{2}} \equiv \pm 1 \mod p.\tag{3}\end{equation}

If \(a\) is a quadratic residue, then there is \(x\in \Z \) with \(x^2 \equiv a \bmod p\). Then \[a^{\frac {p-1}{2}}\equiv x^{p-1} \equiv 1 \mod p.\]

The polynomial \(f(t) = t^{\frac {p-1}{2}} - 1\) has at most \(\frac {p-1}{2}\) roots in \(\F _p^\times \) and we have shown that the \(\frac {p-1}{2}\) quadratic residues are roots of \(f(t)\). Therefore they are all the roots of \(f(t)\).

Thus, if \(a\) is a quadratic non-residue, then \(f(a) \not \equiv 0 \bmod p\) and so \(a^{\frac {p-1}{2}} \not \equiv 1 \bmod p\). By equation (3), \[a^{\frac {p-1}{2}} \equiv -1 \mod p\] as required. □

We essentially already proved this when we derived the multiplication table in the previous section. We give another proof using Euler’s criterion (Theorem 6.4): \[ \legendre {ab}{p}\equiv (ab)^{\frac {p-1}{2}}=a^{\frac {p-1}{2}}b^{\frac {p-1}{2}}\equiv \legendre {a}{p}\legendre {b}{p}\mod p. \] Both sides lie in \(\{0,\pm 1\}\), and no two of these are congruent modulo \(p\) as \(p\) is odd, so they are equal. □

By Theorem 6.4, \(\legendre {-1}{p}\equiv (-1)^{\frac {p-1}{2}}\bmod p\). The right-hand side is \(1\) if \(\frac {p-1}{2}\) is even, i.e. if \(p \equiv 1 \bmod 4\) and \(-1\) if \(\frac {p-1}{2}\) is odd, i.e. if \(p \equiv 3 \bmod 4\). The result follows, as the Legendre symbol is \(\pm 1\) and \(p\) is odd. □

The case \(\omega =1\) is clear. If \(\omega \neq 1\), then \((\omega -1)\sum _{a=0}^{n-1}\omega ^{a}=\omega ^{n}-1=0\), so the sum is \(0\). □

Write \(\zeta =\zeta _{q}\). Expanding, \[ G_{q}^{2}=\sum _{a=1}^{q-1}\sum _{b=1}^{q-1}\legendre {ab}{q}\zeta ^{a+b}. \] For fixed \(a\), as \(c\) runs over \(1,\ldots ,q-1\), the residue of \(ac\) modulo \(q\) runs over \(1,\ldots ,q-1\), so we may substitute \(b=ac\). As \(\legendre {a^{2}c}{q}=\legendre {c}{q}\) by Proposition 6.5, \[ G_{q}^{2}=\sum _{c=1}^{q-1}\legendre {c}{q}\sum _{a=1}^{q-1}\zeta ^{a(1+c)}. \] The inner sum is \(\sum _{a=0}^{q-1}\omega ^{a}-1\), where \(\omega =\zeta ^{1+c}\) satisfies \(\omega ^{q}=1\), and \(\omega =1\) if and only if \(c=q-1\). So by Lemma 6.11, the inner sum is \(q-1\) if \(c=q-1\) and \(-1\) otherwise. By Lemma 6.2, exactly half of \(1,\ldots ,q-1\) are quadratic residues modulo \(q\), so \(\sum _{c=1}^{q-1}\legendre {c}{q}=0\). Hence \begin{align*} G_{q}^{2}&=\legendre {-1}{q}(q-1)-\sum _{c=1}^{q-2}\legendre {c}{q}\\ &=\legendre {-1}{q}(q-1)+\legendre {-1}{q}\\ &=\legendre {-1}{q}q \\ &= q^*, \end{align*}

as required. □

For \(n=2\), the binomial theorem gives \[ (x_{1}+x_{2})^{p}=x_{1}^{p}+x_{2}^{p}+\sum _{k=1}^{p-1}\binom {p}{k}x_{1}^{k}x_{2}^{p-k}, \] and \(p\mid \binom {p}{k}=\frac {p!}{k!(p-k)!}\) for \(0<k<p\), as \(p\) divides the numerator but not the denominator. The general case follows by induction on \(n\). □

1. As \(\zeta _{q}\) is a root of \(x^{q}-1\), \(\zeta _{q}\in \bar {\Z }\), and so \(G_{q}\in \bar {\Z }\) as \(\bar {\Z }\) is a ring (Proposition 5.10).
2. As \(p\nmid q^{*}\), there is \(u\in \Z \) with \(uq^{*}\equiv 1\bmod p\). By Lemma 6.13, \(G_{q}\cdot uG_{q}=uq^{*}\equiv 1\bmod {p\bar {\Z }}\), so \(G_{q}\) is invertible modulo \(p\bar {\Z }\).

□

Otherwise \(2=p\alpha \) for some \(\alpha \in \bar {\Z }\). Then \(\alpha =\frac {2}{p}\in \bar {\Z }\cap \Q =\Z \) by Corollary 5.8, a contradiction as \(p\) is odd. □