---
title: Finite Fields
module: Galois Theory
moduleNumber: 11
lessonNumber: 2
order: 1102
summary: >
  Every finite field has prime-power order, is the splitting field of
  $x^{p^n} - x$, and is unique up to isomorphism. Its extension over the prime
  field is Galois with cyclic group generated by the Frobenius map $x \mapsto
  x^p$, so the Galois correspondence reduces the subfield lattice to the divisor
  lattice of $n$. Möbius inversion counts the irreducible polynomials of each
  degree, and cyclic error-correcting codes are one application.
topics: [Galois Theory]
sources:
  - book: Dummit & Foote
    ref: "Ch. 14 — Galois Theory; §14.3 Finite Fields"
  - book: Judson
    ref: "Ch. 22 — Finite Fields; §22.1 Structure of a Finite Field, §22.2 Polynomial Codes"
draft: false
---

Finite fields are the cleanest testing ground for the
[Galois correspondence](/abstract-algebra/galois-theory/the-galois-correspondence).
Their Galois groups are cyclic, so every subgroup is normal and the intermediate-field
lattice is a divisor lattice. The whole theory of a finite field — how large it can be,
which subfields it has, how its elements factor irreducible polynomials — follows from
one automorphism, the Frobenius map.

## Order and existence

A finite field $\mathbb{F}$ has prime characteristic $p$ (its characteristic cannot be
$0$, and a composite characteristic would produce zero divisors), so it contains the
prime field $\mathbb{F}_p = \mathbb{Z}/p\mathbb{Z}$. As a vector space over $\mathbb{F}_p$
it has some finite dimension $n = [\mathbb{F} : \mathbb{F}_p]$, and a vector space of
dimension $n$ over a field of $p$ elements has exactly $p^n$ elements.

> **Fact (Order of a finite field).** A finite field has $p^n$ elements for a prime $p$
> and integer $n \geq 1$. No finite field has an order that is not a prime power.

The multiplicative group $\mathbb{F}^\times$ has order $p^n - 1$, so every nonzero element
satisfies $\alpha^{p^n - 1} = 1$ by Lagrange, and hence every element (including $0$)
satisfies $\alpha^{p^n} = \alpha$. The $p^n$ elements of $\mathbb{F}$ are therefore
exactly the $p^n$ roots of $x^{p^n} - x$, which means $\mathbb{F}$ is a
[splitting field](/abstract-algebra/field-theory/splitting-fields-and-algebraic-closure)
of that polynomial over $\mathbb{F}_p$.

> **Theorem (Existence and uniqueness).** For each prime power $p^n$ there is a field of
> order $p^n$, namely the splitting field of $x^{p^n} - x$ over $\mathbb{F}_p$, and it is
> unique up to isomorphism. We write $\mathbb{F}_{p^n}$ for it.

Existence is the splitting-field construction: the roots of $x^{p^n} - x$ form a field
because the map $\alpha \mapsto \alpha^{p^n}$ is a ring homomorphism (the Frobenius,
iterated $n$ times), and its fixed set is closed under the field operations. The
polynomial is separable — its derivative is $p^n x^{p^n - 1} - 1 = -1$, which shares no
root with it — so it has $p^n$ distinct roots. Uniqueness holds because any two splitting
fields of the same polynomial over $\mathbb{F}_p$ are isomorphic.[^df-exist]

## The Frobenius automorphism and the Galois group

Because $\mathbb{F}_{p^n}$ is the splitting field of the separable polynomial $x^{p^n} -
x$, the extension $\mathbb{F}_{p^n}/\mathbb{F}_p$ is Galois. Its group is generated by a
single map.

> **Definition (Frobenius).** The **Frobenius automorphism** of $\mathbb{F}_{p^n}$ is
> $\sigma_p : \alpha \mapsto \alpha^p$. It is a field homomorphism because
> $(\alpha + \beta)^p = \alpha^p + \beta^p$ in characteristic $p$ (the binomial
> coefficients $\binom{p}{k}$ for $0 < k < p$ are divisible by $p$), and it is bijective
> because a field homomorphism is injective and $\mathbb{F}_{p^n}$ is finite.

The Frobenius fixes $\mathbb{F}_p$ pointwise, since every $a \in \mathbb{F}_p$ satisfies
$a^p = a$ (Fermat's little theorem). Iterating, $\sigma_p^k(\alpha) = \alpha^{p^k}$, and
$\sigma_p^n = 1$ because $\alpha^{p^n} = \alpha$ for all $\alpha$. No smaller power is the
identity: $\sigma_p^k = 1$ would force $\alpha^{p^k} = \alpha$ for all $p^n$ elements, but
$x^{p^k} - x$ has at most $p^k < p^n$ roots. So $\sigma_p$ has order exactly $n$.

> **Theorem (Cyclic Galois group).** $\operatorname{Gal}(\mathbb{F}_{p^n}/\mathbb{F}_p) =
> \langle \sigma_p \rangle \cong \mathbb{Z}/n\mathbb{Z}$, cyclic of order $n$, generated
> by the Frobenius automorphism.

The Frobenius partitions $\mathbb{F}_{p^n}$ into orbits. The orbit of $\alpha$ is
$\{\alpha, \alpha^p, \alpha^{p^2}, \dots\}$, and its length equals the degree of the
minimal polynomial of $\alpha$ over $\mathbb{F}_p$ — the orbit consists of the Galois
conjugates of $\alpha$.

$$
% caption: Frobenius orbits are the Galois conjugates: repeatedly raising to the $p$th
% power cycles an element through the roots of its minimal polynomial, returning after
% $d$ steps where $d$ is the degree of that polynomial.
\begin{tikzpicture}[scale=1.0, >=stealth, font=\small]
\definecolor{acc}{HTML}{4A6FA5}
\node[draw, circle, inner sep=1.5pt] (a0) at (0:2)   {$a$};
\node[draw, circle, inner sep=1.5pt] (a1) at (60:2)  {$a^{p^{4}}$};
\node[draw, circle, inner sep=1.5pt] (a2) at (120:2) {$a^{p^{3}}$};
\node[draw, circle, inner sep=1.5pt] (a3) at (180:2) {$a^{p^{2}}$};
\node[draw, circle, inner sep=1.5pt] (a4) at (240:2) {$a^{p}$};
\node[font=\footnotesize, acc] at (0,0) {Frobenius};
\draw[->, acc, thick] (a0) to[bend right=18] (a4);
\draw[->, acc, thick] (a4) to[bend right=18] (a3);
\draw[->, acc, thick] (a3) to[bend right=18] (a2);
\draw[->, acc, thick] (a2) to[bend right=18] (a1);
\draw[->, acc, thick] (a1) to[bend right=18] (a0);
\end{tikzpicture}
$$

## The subfield lattice is the divisor lattice

The Galois group $\mathbb{Z}/n\mathbb{Z}$ has exactly one subgroup of each order dividing
$n$: for a divisor $d \mid n$, the subgroup $\langle \sigma_p^d \rangle$ has order $n/d$.
By the Fundamental Theorem, subgroups correspond to intermediate fields, and index
corresponds to degree. Since the group is abelian, every subgroup is normal, so every
intermediate field is Galois over $\mathbb{F}_p$.

> **Theorem (Subfields of a finite field).** The subfields of $\mathbb{F}_{p^n}$ are in
> bijection with the divisors of $n$. For each $d \mid n$ there is exactly one subfield of
> degree $d$ over $\mathbb{F}_p$, namely $\mathbb{F}_{p^d}$, the fixed field of
> $\langle \sigma_p^d \rangle$. Thus $\mathbb{F}_{p^m} \subseteq \mathbb{F}_{p^n}$ if and
> only if $m \mid n$.

The subfield lattice is the divisor lattice of $n$ drawn upside down: containment of
fields matches divisibility of exponents. For $n = 12$ the divisors $1, 2, 3, 4, 6, 12$
produce six subfields.

$$
% caption: The subfields of $\mathbb{F}_{p^{12}}$ reproduce the divisor lattice of $12$:
% $\mathbb{F}_{p^d} \subseteq \mathbb{F}_{p^{12}}$ exactly when $d \mid 12$, with edges
% for divisibility by a prime.
\begin{tikzpicture}[scale=1.0, >=stealth, font=\small]
\definecolor{acc}{HTML}{4A6FA5}
\node (f1)  at (0,0)    {$\mathbb{F}_{p}$};
\node (f2)  at (-1.6,1.4) {$\mathbb{F}_{p^{2}}$};
\node (f3)  at (1.6,1.4)  {$\mathbb{F}_{p^{3}}$};
\node (f4)  at (-1.6,2.8) {$\mathbb{F}_{p^{4}}$};
\node (f6)  at (1.6,2.8)  {$\mathbb{F}_{p^{6}}$};
\node (f12) at (0,4.2)   {$\mathbb{F}_{p^{12}}$};
\draw[black] (f1) -- (f2);
\draw[black] (f1) -- (f3);
\draw[black] (f2) -- (f4);
\draw[black] (f2) -- (f6);
\draw[black] (f3) -- (f6);
\draw[black] (f4) -- (f12);
\draw[black] (f6) -- (f12);
\end{tikzpicture}
$$

Restricting Frobenius to a subfield recovers its own Frobenius: $\sigma_p$ has order $n$
in $\operatorname{Gal}(\mathbb{F}_{p^n}/\mathbb{F}_p)$ but order $d$ in
$\operatorname{Gal}(\mathbb{F}_{p^d}/\mathbb{F}_p)$, and
$\operatorname{Gal}(\mathbb{F}_{p^d}/\mathbb{F}_p)$ is the quotient
$\langle\sigma_p\rangle / \langle\sigma_p^d\rangle$.

## The multiplicative group is cyclic

Every finite subgroup of the multiplicative group of a field is
[cyclic](/abstract-algebra/subgroups-and-quotients/cyclic-groups), a consequence of a
finite field having at most $k$ solutions to $x^k = 1$. Applied to $\mathbb{F}_{p^n}$
itself:

> **Theorem (Primitive element of a finite field).** $\mathbb{F}_{p^n}^\times$ is cyclic
> of order $p^n - 1$. A generator $\theta$ is called a **primitive element**; its powers
> $\theta^0, \theta^1, \dots, \theta^{p^n - 2}$ run through all nonzero elements.

A primitive element generates the whole field over $\mathbb{F}_p$, since it already
generates the multiplicative group, so $\mathbb{F}_{p^n} = \mathbb{F}_p(\theta)$ is a
**simple extension**. Its minimal polynomial has degree $n$, which proves that an
irreducible polynomial of degree $n$ over $\mathbb{F}_p$ exists for every $n \geq 1$.

$$
% caption: The nonzero elements of $\mathbb{F}_{p^n}$ are the powers of a primitive
% element $g$, cycling with period $p^n - 1$ before returning to $1 = g^{0}$ (drawn here
% for eight elements).
\begin{tikzpicture}[scale=1.0, >=stealth, font=\small]
\definecolor{acc}{HTML}{4A6FA5}
\foreach \ang/\lab in {90/{1},45/{g},0/{g^{2}},315/{g^{3}},270/{g^{4}},225/{g^{5}},180/{g^{6}},135/{g^{7}}}
  \node[draw, circle, inner sep=1.3pt, fill=acc!8] (n\ang) at (\ang:2) {$\lab$};
\foreach \a/\b in {90/45,45/0,0/315,315/270,270/225,225/180,180/135,135/90}
  \draw[->, acc, thick] (n\a) to[bend right=12] (n\b);
\node[font=\footnotesize, black] at (0,0) {powers of $g$};
\end{tikzpicture}
$$

### Worked example: constructing $\mathbb{F}_8$

Take $p = 2$, $n = 3$. The polynomial $x^3 + x + 1$ has no root in $\mathbb{F}_2$ (both
$0$ and $1$ evaluate to $1$), so it is irreducible, and
$$
\mathbb{F}_8 = \mathbb{F}_2[x] / (x^3 + x + 1) = \{a + b\theta + c\theta^2 : a, b, c \in \mathbb{F}_2\},
\qquad \theta^3 = \theta + 1,
$$
an $8$-element field with basis $1, \theta, \theta^2$. The element $\theta$ is primitive:
its powers exhaust $\mathbb{F}_8^\times$, each computed by reducing with $\theta^3 =
\theta + 1$.

| $k$ | $\theta^k$ | $k$ | $\theta^k$ |
| --- | --- | --- | --- |
| $0$ | $1$ | $4$ | $\theta^2 + \theta$ |
| $1$ | $\theta$ | $5$ | $\theta^2 + \theta + 1$ |
| $2$ | $\theta^2$ | $6$ | $\theta^2 + 1$ |
| $3$ | $\theta + 1$ | $7$ | $1$ |

The Frobenius orbit of $\theta$ is $\{\theta, \theta^2, \theta^4\}$, and indeed
$$
(x - \theta)(x - \theta^2)(x - \theta^4) = x^3 + x + 1,
$$
as the table confirms: the coefficient of $x^2$ is $\theta + \theta^2 + \theta^4 = \theta +
\theta^2 + (\theta^2 + \theta) = 0$ in characteristic $2$, and the constant term is
$\theta \cdot \theta^2 \cdot \theta^4 = \theta^7 = 1$. The remaining orbit $\{\theta^3,
\theta^6, \theta^5\}$ multiplies out to the other irreducible cubic $x^3 + x^2 + 1$, and
the orbit $\{1\}$ gives $x + 1$. Together with the root $0$, the orbits reassemble
$$
x^8 - x = x(x+1)(x^3 + x + 1)(x^3 + x^2 + 1),
$$
the factorization predicted by the theorem below. Since $3$ is prime, the only subfields
of $\mathbb{F}_8$ are $\mathbb{F}_2$ and $\mathbb{F}_8$ itself — so $\mathbb{F}_4
\not\subseteq \mathbb{F}_8$ even though $4 < 8$: containment follows exponent
divisibility, not size.

## Factoring $x^{p^n} - x$ and counting irreducibles

The polynomial $x^{p^n} - x$ vanishes exactly on $\mathbb{F}_{p^n}$, whose elements
generate subfields $\mathbb{F}_{p^d}$ for the various $d \mid n$. Grouping the linear
factors by the degree $d$ of the minimal polynomial of their root gives a clean product
formula.

> **Theorem (Factorization of $x^{p^n} - x$).** Over $\mathbb{F}_p$, the polynomial
> $x^{p^n} - x$ is the product of all distinct monic irreducible polynomials whose degree
> $d$ divides $n$.

This turns the count of irreducibles into a divisor sum. Let $\psi(d)$ be the number of
monic irreducibles of degree $d$ over $\mathbb{F}_p$. Comparing degrees on both sides of
the factorization gives $p^n = \sum_{d \mid n} d\,\psi(d)$, and
[Möbius inversion](/abstract-algebra/foundations/integers-and-modular-arithmetic) solves
for $\psi$.

> **Theorem (Count of irreducibles).** The number of monic irreducible polynomials of
> degree $n$ over $\mathbb{F}_p$ is
> $$
> \psi(n) = \frac{1}{n} \sum_{d \mid n} \mu(d)\, p^{n/d},
> $$
> where $\mu$ is the Möbius function.

The same factorization produces irreducibles recursively. Over $\mathbb{F}_2$, the
irreducible cubics divide
$$
\frac{x^{8} - x}{x(x-1)} = x^6 + x^5 + x^4 + x^3 + x^2 + x + 1 = (x^3 + x + 1)(x^3 + x^2 + 1),
$$
and the formula agrees: $\psi(3) = \tfrac{1}{3}(2^3 - 2) = 2$.

> **Worked example.** Count the monic irreducible quartics over $\mathbb{F}_2$. The
> divisors of $4$ are $1, 2, 4$, with $\mu(1) = 1$, $\mu(2) = -1$, $\mu(4) = 0$, so
> $$
> \psi(4) = \tfrac{1}{4}\bigl(\mu(1)\,2^4 + \mu(2)\,2^2 + \mu(4)\,2^1\bigr)
>         = \tfrac{1}{4}(16 - 4 + 0) = 3.
> $$
> The three are $x^4 + x + 1$, $x^4 + x^3 + 1$, and $x^4 + x^3 + x^2 + x + 1$. Their
> product, times the linears $x(x+1)$ and the irreducible quadratic $x^2 + x + 1$,
> recovers $x^{16} - x$ — the product of all irreducibles of degree dividing $4$.

A corollary concerns a polynomial irreducible over $\mathbb{Z}$:

> **Corollary.** The polynomial $x^4 + 1$ is irreducible over $\mathbb{Z}$ but reducible
> modulo every prime $p$.

For $p = 2$, $x^4 + 1 = (x+1)^4$. For odd $p$, $8 \mid p^2 - 1$, so $x^8 - 1 \mid x^{p^2 -
1} - 1$; the roots of $x^4 + 1$ (which divides $x^8 - 1$) therefore lie in
$\mathbb{F}_{p^2}$, giving each root degree at most $2$ over $\mathbb{F}_p$. A degree-$4$
polynomial with all roots of degree $\leq 2$ cannot be irreducible.[^df-x4]

Because $\mathbb{F}_{p^m} \subseteq \mathbb{F}_{p^n}$ whenever $m \mid n$, the finite
fields of characteristic $p$ nest into a directed system, and their union is the algebraic
closure:
$$
\overline{\mathbb{F}_p} = \bigcup_{n \geq 1} \mathbb{F}_{p^n}.
$$

## Application: cyclic codes over finite fields

Error-correcting codes exploit finite-field structure directly. A **linear code** of
length $n$ over $\mathbb{F}_q$ is a subspace $C \subseteq \mathbb{F}_q^n$; codewords are
the vectors it contains, and the receiver corrects transmission errors by mapping a
received word back to the nearest codeword. Identifying a vector $(a_0, \dots, a_{n-1})$
with the polynomial $a_0 + a_1 t + \cdots + a_{n-1} t^{n-1}$ realizes $\mathbb{F}_q^n$ as
the [quotient ring](/abstract-algebra/ring-theory/ideals-quotients-and-homomorphisms)
$$
R_n = \mathbb{F}_q[x] / (x^n - 1),
$$
in which multiplication by $t$ cyclically shifts the coefficients. A code closed under
cyclic shifts is a **cyclic code**, and closure under shifts plus linearity amounts to
closure under multiplication by every polynomial.[^judson-cyclic]

> **Theorem (Cyclic codes are ideals).** A linear code $C \subseteq \mathbb{F}_q^n$ is
> cyclic if and only if $C$ is an ideal of $R_n = \mathbb{F}_q[x]/(x^n - 1)$. Since
> $\mathbb{F}_q[x]$ is a
> [principal ideal domain](/abstract-algebra/factorization-and-polynomials/polynomial-rings-over-fields),
> every such ideal is $C = (g(t))$ for a unique monic **generator polynomial** $g(x)$
> dividing $x^n - 1$.

Choosing a code therefore reduces to factoring $x^n - 1$ over $\mathbb{F}_q$ and picking a
divisor $g(x)$. Over $\mathbb{F}_2$ with $n = 7$,
$$
x^7 - 1 = (1 + x)(1 + x + x^3)(1 + x^2 + x^3),
$$
so $g(x) = 1 + x + x^3$ generates a $(7, 4)$ code: messages are the $2^4$ polynomials of
degree less than $4$, each encoded by multiplying by $g(x)$.

$$
% caption: A cyclic code encodes a message polynomial by multiplying it by the generator
% $g(t)$, a divisor of $t^n - 1$; the codewords range over the multiples of $g(t)$ inside
% the quotient ring $R_n$.
\begin{tikzpicture}[scale=1.0, >=stealth, font=\small]
\definecolor{acc}{HTML}{4A6FA5}
\node[draw, minimum width=26mm, minimum height=11mm, align=center] (m) at (0,0) {message\\$m(t)$};
\node[draw, minimum width=30mm, minimum height=11mm, align=center, draw=acc] (c) at (5.4,0) {codeword\\$m(t)\,g(t)$};
\draw[->, acc, thick] (m) -- node[above, font=\footnotesize, black]{multiply by $g(t)$} (c);
\node[font=\footnotesize, black, align=center] at (5.4,-1.5) {an ideal of $R_n$};
\draw[black, ->] (5.4,-1.15) -- (5.4,-0.6);
\end{tikzpicture}
$$

The error-correcting power comes from arranging that $g(x)$ has a run of consecutive
powers of a primitive element among its roots. **BCH codes** choose $g(x)$ as the least
common multiple of the minimal polynomials of $\omega, \omega^2, \dots, \omega^{2t}$ for a
primitive $(n)$th root of unity $\omega$ in an extension field; the resulting code
corrects up to $t$ errors. The construction rests on the Galois theory of finite fields:
minimal polynomials over $\mathbb{F}_q$ are Frobenius orbits, and the code's
guarantees are theorems about roots of unity in $\mathbb{F}_{q^m}$.[^judson-bch]

[^df-exist]: **Dummit & Foote**, _Abstract Algebra_, §14.3, Proposition 15 — a finite field is isomorphic to $\mathbb{F}_{p^n}$, the splitting field of $x^{p^n} - x$ over $\mathbb{F}_p$, with cyclic Galois group of order $n$ generated by the Frobenius automorphism.
[^df-x4]: **Dummit & Foote**, _Abstract Algebra_, §14.3, Corollary 16 — $x^4 + 1$ is irreducible over $\mathbb{Z}$ but factors modulo every prime, because its roots always lie in $\mathbb{F}_{p^2}$.
[^judson-cyclic]: **Judson**, _Abstract Algebra: Theory and Applications_, §22.2, Theorem 22.10 — a linear code is cyclic iff it is an ideal of $R_n = \mathbb{F}_q[x]/(x^n - 1)$, generated by the unique monic divisor of $x^n - 1$ of least degree.
[^judson-bch]: **Judson**, _Abstract Algebra: Theory and Applications_, §22.2 — generator matrices, the BCH construction from consecutive powers of a primitive root of unity, and the resulting error-correction bound.