Introduction
In physics, a Field, such as a magnetic field, is defined by its influence. It is a region
of space where physical forces are felt. While it is naturally bounded by its own reach, it is described by a
physical quantity assigned to every point of that region.
In mathematics, the term Field carries a different weight. Its original German name, Körper,
literally means 'Body', suggesting a self-contained, organically closed whole.
This describes a system defined not by its reach in space, but by its internal arithmetic. It is so complete
that this arithmetic never escapes its own boundaries. Addition, subtraction, multiplication, and division by
nonzero elements all return elements of the field itself.
The limitation of such a perfect "Body" is its inability to spontaneously evolve. If a field cannot solve a specific polynomial
equation, it has no "internal logic" to find the answer. The real numbers \(\mathbb{R}\), for instance,
cannot solve \(x^2 + 1 = 0\). Closure under its own operations keeps all arithmetic inside the field, but
it does not supply the roots the field lacks.
To progress, we must perform a mathematical "transplant." We must force this closed whole open and graft new dimensions
onto its structure. This process of expanding a perfect system into a larger, more capable universe is what we call
Extension Fields.
Splitting Field
While the Fundamental Theorem gives us one zero, practical applications often require the complete picture.
In structural terms, we seek the minimal sufficient environment that fully resolves the polynomial.
Definition: Adjoining Elements
Let \(E\) be an extension field of \(F\) and let \(a_1, a_2, \ldots, a_n \in E\). An intersection
of subfields of \(E\) is
again a subfield, since every subfield contains \(0\) and \(1\), and a sum,
product, negative or inverse formed from elements lying in all of them again lies in all of them. We
may therefore write \(F(a_1, a_2, \ldots, a_n)\) for the intersection of all subfields of \(E\) that
contain \(F\) together with \(a_1, a_2, \ldots, a_n\), the smallest such subfield. An extension of
the form \(F(a)\), obtained by adjoining a single element, is called a simple extension
of \(F\).
Definition: Splitting Field
Let \(E\) be an extension field of \(F\) and let \(f(x) \in F[x]\) with degree at least 1. We say that
\(f(x)\) splits in \(E\) if there are elements \(a \in F\) and \(a_1, a_2, \ldots, a_n \in E\) such that
\[
f(x) = a(x - a_1)(x - a_2) \cdots (x - a_n).
\]
We call \(E\) a splitting field for \(f(x)\) over \(F\) if
\(E = F(a_1, a_2, \ldots, a_n)\).
This definition emphasizes minimality. A splitting field is the smallest field containing
\(F\) together with every zero of the polynomial, so it carries nothing that the polynomial does not force.
It represents the closure of the problem space, and no resources are spent on structure the
problem never asked for.
Theorem: Existence of Splitting Fields
Let \(F\) be a field and let \(f(x)\) be a nonconstant element of \(F[x]\). Then there exists a
splitting field \(E\) for \(f(x)\) over \(F\).
We omit the proof. The argument adjoins one zero at a time, applying the Fundamental Theorem of Field
Theory repeatedly until the polynomial factors completely.
The existence of a splitting field confirms that every polynomial equation implies a specific, natural geometry
where it decomposes entirely. For computer scientists, this structure is the basis for Galois Theory, which
ultimately connects the discrete symmetry of zeros (permutations) to the solvability of the equation itself.
Theorem: \(F(a) \cong F[x] \, / \langle p(x) \rangle\)
Let \(F\) be a field and let \(p(x) \in F[x]\) be irreducible over \(F\). If \(a\) is a zero of \(p(x)\) in
some extension \(E\) of \(F\), then \(F(a)\) is isomorphic to \(F[x] \, / \langle p(x) \rangle\).
Furthermore, if \(\deg p(x) = n\), then every member of \(F(a)\) can be uniquely expressed in the
form
\[
c_{n-1}a^{n-1} + c_{n-2}a^{n-2} + \cdots + c_1 a + c_0,
\]
where \(c_0, c_1, \ldots, c_{n-1} \in F\).
Proof Sketch:
Consider a function \(\phi: F[x] \to F(a)\) defined by \(\phi(f(x)) = f(a)\). Since \(F(a)\) is
commutative, substituting \(a\) for \(x\) respects both sums and products, so this \(\phi\) is a ring
homomorphism. We claim that
\[
\operatorname{Ker} \phi = \langle p(x) \rangle.
\]
Since \(p(a) = 0\), we have \(p(x) \in \operatorname{Ker} \phi\). Because
Kernels are Ideals,
it follows that
\[
\langle p(x) \rangle \subseteq \operatorname{Ker} \phi.
\]
On the other hand, \(p(x)\) is irreducible over \(F\). By the
characterization of \(\langle p(x) \rangle\) as maximal,
the ideal \(\langle p(x) \rangle\) is maximal in \(F[x]\).
Since \(\phi\) is non-trivial (as \(\phi(1) = 1 \neq 0\)), we have
\[
\operatorname{Ker} \phi \neq F[x].
\]
By the definition of a
maximal ideal, the only
ideals of \(F[x]\) containing \(\langle p(x) \rangle\) are \(\langle p(x) \rangle\) itself and
\(F[x]\), so we must have
\[
\operatorname{Ker} \phi = \langle p(x) \rangle.
\]
By the
First Isomorphism Theorem for Rings,
\(\phi(F[x])\) is isomorphic to \(F[x] \, / \langle p(x) \rangle\). Since \(\langle p(x) \rangle\) is
maximal, the
characterization of factor rings as fields via maximal ideals
makes \(F[x] \, / \langle p(x) \rangle\) a field, and therefore \(\phi(F[x])\) is a subfield of \(F(a)\).
Moreover, \(\phi(F[x])\) contains both \(F\) (since constant polynomials evaluate to themselves: \(\phi(c) = c\)
for all \(c \in F\)) and \(a\) (since \(\phi(x) = a\)).
So \(\phi(F[x])\) is a subfield of \(E\) that contains \(F\) and \(a\), while
Adjoining Elements makes \(F(a)\)
the smallest such subfield. Hence
\[
F[x] \, / \langle p(x) \rangle \cong \phi(F[x]) = F(a).
\]
Finally, by the
Division Algorithm
in \(F[x]\), every polynomial \(f(x) \in F[x]\) can be written as
\(f(x) = q(x)p(x) + r(x)\) where \(\deg r(x) \lt n\) or \(r(x) = 0\). Thus, every element of
\(F[x] \, / \langle p(x) \rangle\) has a unique representative of the form
\[
c_{n-1} x^{n-1} + \cdots + c_1 x + c_0 + \langle p(x) \rangle,
\]
where \(c_0, \ldots, c_{n-1} \in F\).
Under the induced isomorphism \(\overline{\phi} : F[x] \, / \langle p(x) \rangle \to F(a)\), the coset
\(c_k x^k + \langle p(x) \rangle\) maps to \(c_k a^k\). Therefore, every element of \(F(a)\)
can be uniquely expressed as \(c_{n-1}a^{n-1} + \cdots + c_1 a + c_0\) where
\(c_0, \ldots, c_{n-1} \in F\).
This is the most critical theorem for implementation. Extending a field does not require "magic." The new
elements behave exactly like polynomials modulo \(p(x)\). In computer science, this defines the
data structure. An element of the extension field \(GF(2^n)\) is simply stored as a
vector of coefficients \([c_{n-1}, \ldots, c_0]\), and arithmetic is performed as polynomial operations.
From Theory to Hardware: The Engineering Perspective
The isomorphism \(F(a) \cong F[x] \, / \langle p(x) \rangle\) is not just an abstract beauty. It is the
exact specification for high-speed hardware and software implementations.
-
Deterministic Memory Footprint:
Because every element is uniquely represented by a polynomial of degree less than \(n\), an element of
\(GF(2^n)\) occupies exactly \(n\) bits, and when \(n\) is at most the machine word size it fits in a single register.
For instance, in AES (where \(n=8\)), every field element is exactly 1 byte.
-
Addition is XOR:
When working over \(GF(2)\), adding two coefficients is exactly the XOR
operation. Whenever the whole element fits in a machine word, field addition is therefore a single
CPU instruction, independent of which \(n\) that word holds.
-
Multiplication and "Overflow":
Multiplying two elements is treated as polynomial multiplication. When the result's degree reaches \(n\),
we use the irreducible polynomial \(p(x)\) as a "mask" to bring the result back into the \(n\)-bit range.
Real-World Example: AES-128:
In the Advanced Encryption Standard (AES), every byte is treated as an element of the
finite field \(GF(2^8)\). To maintain the closure and symmetry required for encryption, AES defines its arithmetic
via the specific irreducible polynomial:
\[
p(x) = x^8 + x^4 + x^3 + x + 1.
\]
When we perform multiplication in the MixColumns step, we often compute \(x \cdot f(x)\).
In hardware, this is a simple left-shift. However, if the result has an \(x^8\) term
(that is, the most significant bit was 1 before the shift), the result has "escaped" the 8-bit
boundary.
According to the isomorphism theorem, we must reduce this result modulo \(p(x)\).
Since \(p(x) \equiv 0 \pmod{p(x)}\), it follows that:
\[
x^8 \equiv x^4 + x^3 + x + 1 \pmod{p(x)}.
\]
In binary, the polynomial \(x^4 + x^3 + x + 1\) is represented as 00011011, or 0x1B.
Therefore, "reducing the field" in a high-performance CPU does not require complex division. It only
requires a conditional XOR with 0x1B.
The constant 0x1B seen in cryptographic source code is not an arbitrary magic number. It is
the direct representation of the coefficients of \(p(x)\) below \(x^8\), that is, of the residue of \(x^8\) modulo \(p(x)\).
// The xtime idiom, as it appears in AES implementations
#define _poly 0x1b
// ...
t = ((a << 1) ^ ((a & 0x80) ? _poly : 0)) & 0xff;
\(GF(2^8)\) Multiplication Visualizer
The visualizer below turns the
structure theorem for \(F(a)\)
into something we can watch. It computes the same product \(a \cdot b\) in \(GF(2^8)\) twice, by two
independently implemented routes shown side by side. The theorem route works where the
theorem lives. It expands \(a(x) \cdot b(x)\) in \(F_2[x]\) as a sum of shifted copies of \(a(x)\),
one per set bit of \(b\), producing a polynomial of degree up to 14. It then performs the long division
by \(p(x)\), killing each term of degree \(\geq 8\) with an aligned copy of \(p(x)\), and keeps the
remainder.
The hardware route is the AES implementation. Eight iterations of
shift-and-conditional-XOR never leave a single byte, and the running accumulator is displayed at every
step so that the answer assembles in view. The bar at the bottom states the punchline. The two final
bytes agree, and the demo's built-in self-tests verify this agreement exhaustively over all
\(65{,}536\) input pairs before the demo is allowed to render. That universal agreement shows that
shift-and-XOR on bytes is multiplication in \(F_2[x] \, / \langle p(x) \rangle\), and because
\(p(x)\) is irreducible, this quotient ring is the field \(GF(2^8)\).
Three experiments are worth running. The preset 57·83 expands to degree \(13\), and its
long division uses two aligned copies of \(p(x)\). The preset
53·CA lands on \(\mathtt{0x01}\). These two bytes are multiplicative inverses, and the
existence of an inverse for every nonzero byte is precisely what the AES S-box is built on. That
property is what makes \(F_2[x] \, / \langle p(x) \rangle\) a field rather than a mere ring, and it follows from the
characterization of \(F[x] \, / \langle p(x) \rangle\) as a field
together with the irreducibility of \(p(x)\).
Finally, 87·02 needs a single reduction, since only the shift in the first row overflows
into \(x^8\) before the product is complete. Its grayed-out trailing rows illustrate why constant-time
implementations run all eight iterations regardless of the input. A data-independent step count, together
with branch-free masking in place of the conditional XORs, keeps the running time independent of the
operands and so resists timing side-channel attacks.
Lemma: Isomorphism Extension \(\phi: F \to F'\)
Let \(F\) be a field and let \(p(x) \in F[x]\) be irreducible over \(F\), and let \(a\) be a zero
of \(p(x)\) in some extension of \(F\). Let \(\phi\) be a field isomorphism from \(F\) to \(F'\),
and write \(\phi(p(x))\) for the polynomial obtained by applying \(\phi\) to each coefficient of
\(p(x)\). If \(b\) is a zero of \(\phi(p(x))\) in some extension of \(F'\), then there is an
isomorphism from \(F(a)\) to \(F'(b)\) that agrees with \(\phi\) on \(F\) and carries \(a\) to \(b\).
We state this lemma without proof. It ensures consistency when mapping between isomorphic systems, and it
is the logical bridge to the uniqueness of splitting fields.
Corollary: Uniqueness of Splitting Fields
Let \(F\) be a field and let \(f(x)\) be a nonconstant element of \(F[x]\). Then any two splitting
fields of \(f(x)\) over \(F\) are isomorphic.
The proof is an induction on the degree of \(f(x)\) that repeatedly applies the isomorphism extension
lemma, and we do not carry it out here.
This corollary guarantees that the "Splitting Field" is a standard, canonical object. It implies that no matter
which algorithm or sequence of operations we use to construct the field, the final algebraic structure is effectively
identical (isomorphic). For a developer, this means the "environment" provided by the math is deterministic
and reliable.
Repeated Zeros and the Formal Derivative
Over a splitting field, \(f(x)\) factors into linear factors, and nothing in the definition forces these
factors to be distinct. Let \(f(x) \in F[x]\) be nonzero and let \(\alpha\) be a zero of \(f(x)\) in an
extension field \(E\) of \(F\). We call \(\alpha\) a repeated zero of \(f(x)\) if
\((x - \alpha)^2\) divides \(f(x)\) in \(E[x]\). Equivalently, the multiplicity of \(\alpha\), defined
alongside the bound on the number of zeros of a polynomial, is
at least \(2\) when \(f(x)\) is regarded as an element of \(E[x]\). The formal derivative defined below
detects repeated zeros.
The definition is a rule on coefficients, so it makes sense over every field, including the finite ones,
where no notion of limit is available. Over \(\mathbb{R}\) it agrees with the derivative of calculus, but in
characteristic \(p\), with \(p\) prime, it can behave differently. The polynomial \(x^p\) has formal
derivative \(p \cdot x^{p-1} = 0\), although \(x^p\) is not constant.
Proof:
Write \(f(x) = \sum_k a_k x^k\) and \(g(x) = \sum_k b_k x^k\), with all but finitely many coefficients
equal to \(0\). For \(k \geq 1\), the coefficient of \(x^{k-1}\) in \(\bigl(f(x) + g(x)\bigr)'\) is
\(k \cdot (a_k + b_k) = k \cdot a_k + k \cdot b_k\), because addition in \(F\) is commutative and
associative. Likewise, the corresponding coefficient in \(\bigl(c f(x)\bigr)'\) is
\(k \cdot (c a_k) = c\,(k \cdot a_k)\) by distributivity. These are the first two rules.
For the product rule, both sides are additive in \(f\) when \(g\) is fixed. The left side is additive
because multiplication in \(F[x]\) distributes over addition and the first rule applies. So is the right
side, by the first rule and distributivity. Both sides are likewise additive in \(g\). Every
polynomial is a finite sum of monomials, so it suffices to treat \(f(x) = s x^i\) and \(g(x) = t x^j\).
If \(i = 0\), then \(f(x)\) is the constant \(s\), and both sides equal \(s g'(x)\) by the second rule,
since \(f'(x) = 0\). The case \(j = 0\) follows in the same way. If \(i, j \geq 1\), then
\(f(x) g(x) = st\, x^{i+j}\), and
\[
\begin{align*}
f'(x) g(x) + f(x) g'(x)
&= (i \cdot s)\, t\, x^{i+j-1} + s\, (j \cdot t)\, x^{i+j-1} \\\\
&= \bigl((i + j) \cdot st\bigr) x^{i+j-1} \\\\
&= \bigl(f(x) g(x)\bigr)'.
\end{align*}
\]
Lemma: A Repeated Zero Is a Zero of the Derivative
Let \(E\) be an extension field of a field \(F\), let \(f(x) \in F[x]\), and let \(\alpha \in E\). If
\((x - \alpha)^2\) divides \(f(x)\) in \(E[x]\), then \(f'(\alpha) = 0\).
Proof:
Because \(E\) is an extension field of \(F\), each coefficient \(k \cdot a_k\) of \(f'(x)\) is the
same whether it is formed in \(F\) or in \(E\). Thus \(f'(x)\) is also the formal derivative of
\(f(x)\) regarded as an element of \(E[x]\). Write \(f(x) = (x - \alpha)^2 g(x)\) with
\(g(x) \in E[x]\). The formal derivative of \(x - \alpha\) is \(1\), so the product rule of the
Rules for the Formal Derivative
gives \(\bigl((x - \alpha)^2\bigr)' = (x - \alpha) + (x - \alpha) = 2 \cdot (x - \alpha)\). Applying the
product rule once more, we obtain
\[
f'(x) = 2 \cdot (x - \alpha) g(x) + (x - \alpha)^2 g'(x).
\]
Both terms on the right carry the factor \(x - \alpha\). Substitution of \(\alpha\) for \(x\) respects sums
and products, as noted in the discussion following the Division
Algorithm, so setting \(x = \alpha\) in this identity gives \(f'(\alpha) = 0\).
The lemma turns a repeated zero into a common zero of \(f(x)\) and \(f'(x)\). For an irreducible
polynomial in characteristic \(0\), this rules out repeated zeros altogether.
Theorem: No Repeated Zeros in Characteristic \(0\)
Let \(F\) be a field of characteristic \(0\) and let \(f(x) \in F[x]\) be irreducible over \(F\). Then for
every extension field \(E\) of \(F\), no \(\alpha \in E\) is a repeated zero of \(f(x)\). That is, there is
no \(\alpha \in E\) such that \((x - \alpha)^2\) divides \(f(x)\) in \(E[x]\).
Proof:
An irreducible polynomial is nonzero, so we may write \(f(x) = a_n x^n + \cdots + a_0\) with
\(a_n \neq 0\). If \(n = 0\), then \(f(x) = a_0\) is a nonzero constant and hence a unit of \(F[x]\)
with inverse \(a_0^{-1}\), which an irreducible polynomial is not. Hence \(n \geq 1\). The leading
coefficient of \(f'(x)\) is \(n \cdot a_n = (n \cdot 1)\, a_n\). If \(n \cdot 1 = 0\), then
\(n \cdot y = (n \cdot 1)\, y = 0\) for every \(y \in F\), which contradicts
characteristic \(0\).
So \(n \cdot 1 \neq 0\), and \(n \cdot a_n \neq 0\) because a product of nonzero elements of a field is
nonzero. Therefore \(f'(x) \neq 0\) and \(\deg f'(x) = n - 1\).
Suppose, for contradiction, that \((x - \alpha)^2\) divides \(f(x)\) in \(E[x]\) for some
\(\alpha \in E\). Then \(f(\alpha) = 0\), and \(f'(\alpha) = 0\) by
A Repeated Zero Is a Zero of the Derivative.
Consider
\[
I = \{h(x) \in F[x] \mid h(\alpha) = 0\}.
\]
Each \(h(x) \in F[x]\) is evaluated at \(\alpha\) as an element of \(E[x]\), and evaluation is compatible
with addition and multiplication. Hence \(I\) contains \(0\), contains \(h_1(x) - h_2(x)\) whenever it contains
\(h_1(x)\) and \(h_2(x)\), and contains \(w(x) h_1(x)\) for every \(w(x) \in F[x]\). By the
Ideal Test, \(I\) is an ideal of
\(F[x]\). As
\(F[x]\) is a principal ideal domain,
\(I = \langle m(x) \rangle\) for some \(m(x) \in F[x]\). The constant \(1\) does not lie in \(I\), since
\(1 \neq 0\) in \(E\). Therefore \(m(x)\) is not a unit, for otherwise \(1 = m(x)\, m(x)^{-1} \in I\).
Since \(f(x) \in I\), we can write \(f(x) = m(x) u(x)\) with \(u(x) \in F[x]\). The polynomial \(f(x)\)
is irreducible, and \(m(x)\) is not a unit, which forces \(u(x)\) to be a unit and gives
\(m(x) = f(x) u(x)^{-1}\). Since \(f'(x) \in I\) as well, \(f'(x) = m(x) v(x)\) for some
\(v(x) \in F[x]\), that is,
\[
f'(x) = f(x)\, u(x)^{-1} v(x).
\]
Here \(u(x)^{-1} v(x) \neq 0\) because \(f'(x) \neq 0\). Since \(F\) is a field, it is an
integral domain,
so the Degree of a Product
gives \(\deg f'(x) \geq \deg f(x) = n\). This contradicts \(\deg f'(x) = n - 1\).
Characteristic \(0\) enters the proof at one point only, the nonvanishing of the leading coefficient
\(n \cdot a_n\). This coefficient vanishes in characteristic \(p\) whenever \(p\) divides \(n\), and the
argument breaks down. Both results return on the two paths introduced next. In the study of algebraic
extensions, the theorem supplies the distinct zeros on which the
Primitive Element Theorem
depends. In the study of finite fields, the fact that a repeated zero is a zero of the formal derivative
shows that \(x^{p^n} - x\) has distinct zeros, because its formal derivative is the nonzero constant \(-1\).
The Crossroads: Two Paths Forward
We have now established the shared foundation of field extensions. The Fundamental Theorem guarantees
zeros exist, splitting fields provide minimal complete environments, extensions of the form
\(F(a)\) have concrete polynomial representations, and the formal derivative detects repeated zeros.
From this foundation, two distinct paths emerge.
Each leads to different applications in modern computing.
Path A: Continuous Symmetry and Geometry (Algebraic Extensions → Geometric Deep Learning)
The first path, Algebraic Extensions, develops the theory of degree and the
Tower Law, which states that for a tower of fields \(F \subseteq E \subseteq K\),
\[
[K:F] = [K:E][E:F].
\]
The degree \([K:F]\) is the dimension of \(K\) as a vector space over \(F\), so the Tower Law says that
dimension multiplies along a chain of extensions. The same habit of reading the size of a structure off a
chain returns in Lie theory, where the dimensions of groups such as \(SO(3)\) and \(SE(3)\) are counted
from the constraints that define them.
Destination: Lie Groups, Lie Algebras, Geometric Deep Learning (equivariant neural networks,
diffusion models on manifolds).
Path B: Discrete Computation and Security (Finite Fields → Cryptography & Coding Theory)
The alternative path, Finite Fields, focuses on the remarkable structure of \(GF(p^n)\):
- Classification. For each prime power \(p^n\), there exists exactly one field
(up to isomorphism).
- Cyclic Multiplicative Group. The nonzero elements form a cyclic group,
\(GF(p^n)^* \cong \mathbb{Z}_{p^n - 1}\).
- Frobenius Automorphism. The map \(\phi(a) = a^p\) generates all field automorphisms.
These properties are the mathematical engine behind AES encryption (using \(GF(2^8)\)),
Elliptic Curve Cryptography, and Reed-Solomon codes (used in QR codes,
CDs, and deep-space communication).
Destination: Applied Cryptography, Error-Correcting Codes, Post-Quantum Cryptography.