Classification of finite fields

Theorem

Classification of finite fields

T-093Home MU-303Threads structure

Statement

Let \(p\) be prime and \(n \in \mathbb{N}\), \(n \ge 1\), and set \(q = p^n\). Then there exists a field of order \(q\), and any two fields of order \(q\) are isomorphic. Conversely, every finite field \(F\) has order \(p^n\) for some prime \(p\) and some \(n \ge 1\) (its characteristic and its dimension over the prime subfield). Consequently the finite fields are, up to isomorphism, in exact bijection with the prime powers, and we may write \(\mathbb{F}_q\) (or \(\mathrm{GF}(q)\)) unambiguously for "the" field of order \(q = p^n\); concretely \(\mathbb{F}_q\) is the splitting field of \(x^q - x\) over \(\mathbb{F}_p\).

Why it matters

This theorem completely settles the existence-and-uniqueness question for finite fields: the answer is as clean as it could possibly be — one isomorphism class per prime power, none at any other order. It converts "finite field" from a vague algebraic notion into a fully classified family indexed by two integers \((p,n)\), which is why one can simply write \(\mathbb{F}_{2^8}\) or \(\mathbb{F}_{3^5}\) and know exactly what is meant, regardless of which explicit construction (irreducible polynomial, matrix representation, etc.) is used to build it.

It is also the load-bearing result underneath the rest of MU-303's treatment of finite fields: the cyclicity of \(\mathbb{F}_q^\times\), the structure of \(\mathrm{Gal}(\mathbb{F}_{p^n}/\mathbb{F}_p)\) as a cyclic group generated by Frobenius, and the subfield criterion \(\mathbb{F}_{p^m} \subseteq \mathbb{F}_{p^n} \iff m \mid n\) all take this classification as their starting point.

Hypotheses

\(p\) is prime.If the modulus is not prime — say \(6 = 2\cdot 3\) — then \(\mathbb{Z}/6\mathbb{Z}\) is a ring with zero divisors (\(2\cdot 3 = 0\)), not a field, and in fact no field of order \(6\) exists at all: the theorem's existence half fails outright for non-prime-power orders. \(n\) is a positive integer.Dropping this (allowing \(n=0\)) is really just the degenerate case \(q=1\); there is no field with one element under the usual axioms (a field must have \(0 \ne 1\)), so \(n \ge 1\) is needed for the statement to refer to an actual field. Uniqueness is asserted only up to isomorphism, not as literal set-equality.\(\mathbb{F}_2[x]/(x^2+x+1)\) and an abstractly constructed splitting field of \(x^4-x\) inside some algebraic closure of \(\mathbb{F}_2\) are typically different sets with different elements, yet both are "the" field of order 4; without the "up to isomorphism" qualifier the uniqueness claim would be simply false, since one can always relabel elements to get a literally different field of the same order. Finiteness of the field.For infinite cardinalities the analogous uniqueness statement is false: \(\mathbb{Q}(i)\) and \(\mathbb{Q}(\sqrt2)\) are both countably infinite fields but are not isomorphic (e.g. \(x^2+1\) has a root in one but not the other), so "one field per cardinality" is a genuinely finite phenomenon, not a general fact about fields.

Proof

\text{If } F \text{ is a finite field then } \operatorname{char}(F) = p \text{ is prime, and } |F| = p^n \text{ where } n = [F : \mathbb{F}_p].

The characteristic of any field is \(0\) or a prime (the kernel of \(\mathbb{Z} \to F\) is a prime ideal of \(\mathbb{Z}\) because \(F\) is a domain); characteristic \(0\) is impossible since it would force \(F\) to contain a copy of \(\mathbb{Z}\), hence be infinite. So \(\operatorname{char}(F)=p\) prime, the prime subfield of \(F\) is \(\mathbb{F}_p\), and \(F\) is a finite-dimensional \(\mathbb{F}_p\)-vector space (finite implies finite-dimensional); if \(n=\dim_{\mathbb{F}_p}F\) then choosing a basis gives a bijection \(F \cong \mathbb{F}_p^n\), so \(|F|=p^n\). A

\text{Fix a prime } p \text{ and } n\ge 1, \text{ let } q=p^n, \text{ and let } L \text{ be a splitting field of } f(x)=x^{q}-x \text{ over } \mathbb{F}_p.

Splitting fields exist for any polynomial over any field (standard existence-of-splitting-fields lemma, built by iteratively adjoining roots via \(K[x]/(g(x))\) for irreducible factors \(g\)); apply it to \(f\) over the base field \(\mathbb{F}_p\). A

f(x)=x^{q}-x \text{ has } q \text{ pairwise distinct roots in } L.

The formal derivative is \(f'(x) = q x^{q-1} - 1\); since \(q=p^n\equiv 0\) in characteristic \(p\), this collapses to \(f'(x)=-1\), a nonzero constant. By the repeated-root criterion (\(\alpha\) is a repeated root of \(f\) iff \(f(\alpha)=f'(\alpha)=0\), equivalently iff \(\gcd(f,f')\neq 1\) in \(L[x]\)), and \(\gcd(f,-1)=1\) trivially, \(f\) has no repeated roots. As \(\deg f = q\), \(f\) has exactly \(q\) distinct roots in its splitting field \(L\). B

R := \{a \in L : a^{q} = a\} \text{ is a subfield of } L, \text{ and } |R| = q.

Let \(\varphi:L\to L\), \(\varphi(a)=a^p\), be the Frobenius map; it is a ring homomorphism because in characteristic \(p\), \((a+b)^p = a^p+b^p\) (the "freshman's dream": all middle binomial coefficients \(\binom{p}{k}\), \(0\lt k\lt p\), are divisible by \(p\)) and \((ab)^p=a^pb^p\) trivially. A ring homomorphism out of a field is injective (its kernel is an ideal of the field \(L\), hence \(0\) or all of \(L\); it is not all of \(L\) since \(\varphi(1)=1\ne 0\)), and an injective map from a finite set to itself is bijective, so \(\varphi\) is a field automorphism of \(L\); consequently so is \(\varphi^n(a)=a^{p^n}=a^{q}\). The fixed field of any automorphism (or set of automorphisms) of a field is always a subfield (closure under \(+,-,\times\), inverses, and containing \(0,1\) all transfer immediately from the automorphism property), so \(R=\operatorname{Fix}(\varphi^n)\) is a subfield of \(L\). But \(R\) is precisely the root set of \(f(x)=x^q-x\) from Step 3, so \(|R|=q\). C

L = R, \text{ so } L \text{ is a field of order } q; \text{ this proves existence.}

\(L\) is by definition the splitting field of \(f\), i.e. the smallest subfield of an algebraic closure containing \(\mathbb{F}_p\) and all roots of \(f\); since \(R\) already is a subfield of \(L\) containing \(\mathbb{F}_p\) (every \(a\in\mathbb{F}_p\) satisfies \(a^p=a\) by Fermat's little theorem, hence \(a^q=a\) by iterating) and containing all roots of \(f\) (that is the definition of \(R\)), minimality of \(L\) forces \(L=R\). Hence \(|L|=q\), giving a field of order \(q\) for every prime power \(q\). B

\text{If } F \text{ is any field with } |F|=q=p^n, \text{ then } a^{q}=a \text{ for every } a\in F.

The multiplicative group \(F^\times\) has order \(q-1\); by Lagrange's theorem every \(a\in F^\times\) satisfies \(a^{q-1}=1\), so \(a^{q}=a\). This also holds trivially for \(a=0\). A

\text{Every field } F \text{ of order } q \text{ is (isomorphic to) a splitting field of } x^{q}-x \text{ over } \mathbb{F}_p.

By Step 6 every element of \(F\) is a root of \(x^q-x\); since \(F\) has exactly \(q=\deg(x^q-x)\) elements, \(F\) is exactly the set of roots of this polynomial, so \(x^q-x\) splits completely into linear factors over \(F\) and \(F\) is generated over its prime subfield \(\mathbb{F}_p\) (which \(F\) contains by Step 1, as \(|F|=p^n\)) by these roots — because \(F\) itself equals that root set. This is precisely the defining property of a splitting field of \(x^q-x\) over \(\mathbb{F}_p\). B

\text{Any two splitting fields of the same polynomial over the same base field are isomorphic; hence uniqueness.}

This is the standard uniqueness-of-splitting-fields lemma (proved by induction on degree, extending an isomorphism of base fields factor-by-factor through the irreducible factors used to build each splitting field, using that \(K[x]/(g)\)'s are determined up to isomorphism by \(g\)). Applying it to the two splitting fields of \(x^q-x\) over \(\mathbb{F}_p\) furnished by Step 7 for any two fields \(F, F'\) of order \(q\) gives \(F \cong F'\). Combined with Step 5 (existence) and Step 1 (every finite field has prime-power order), this completes the classification. C

Result

\text{For each prime power } q=p^n,\ \exists!\, \mathbb{F}_q \text{ (up to isomorphism), the splitting field of } x^{q}-x \text{ over } \mathbb{F}_p.

Reading. Finite fields come in exactly one flavour per prime-power size: build one by any method you like — an irreducible polynomial of degree \(n\) over \(\mathbb{F}_p\), a splitting field, a matrix ring construction — and you always land on the same field up to relabelling. There is no field at all of any non-prime-power order.

Scope. Applies to every prime \(p\) and every \(n\ge1\), with no further restriction; it is a statement purely about finite fields and says nothing about infinite fields, where uniqueness by cardinality fails.

Corollaries & converses

The notation \(\mathbb{F}_q\) or \(\mathrm{GF}(q)\) is well-defined for every prime power \(q\): existence and uniqueness together mean "the field of order \(q\)" genuinely picks out one isomorphism class.
Subfield criterion (uses this theorem): \(\mathbb{F}_{p^m}\) embeds in \(\mathbb{F}_{p^n}\) iff \(m \mid n\); the embedding, when it exists, is unique. (Proof sketch: an \(\mathbb{F}_p\)-subfield of \(\mathbb{F}_{p^n}\) has order \(p^m\) for some \(m\), and must itself be *the* field of order \(p^m\) by this theorem; a short group-theoretic argument on \((p^m-1)\mid(p^n-1)\) shows this forces \(m\mid n\), and conversely \(x^{p^m}-x \mid x^{p^n}-x\) when \(m\mid n\).)
\(\mathrm{Gal}(\mathbb{F}_{p^n}/\mathbb{F}_p)\) is cyclic of order \(n\), generated by the Frobenius automorphism \(\varphi(a)=a^p\) from Step 4 of the proof — a free byproduct of having identified \(\mathbb{F}_{p^n}\) as \(\operatorname{Fix}\) of powers of \(\varphi\).
The converse direction ("every order that has a field is a prime power") is not a separate fact to check — it is literally Step 1 of the proof, so existence and the converse are two halves of one classification, not independent claims.
The theorem does not assert \(\mathbb{F}_{p^n} \cong \mathbb{Z}/p^n\mathbb{Z}\) as rings for \(n\gt1\); indeed \(\mathbb{Z}/p^n\mathbb{Z}\) is not even a field for \(n\gt1\) (it has zero divisors, e.g. \(p \cdot p^{n-1}\equiv 0\)), so no such converse holds.

Fails without

Drop "prime power": there is no field of order \(6\), \(10\), \(12\), or any composite integer that is not a prime power — e.g. a hypothetical field of order 6 would need a subgroup structure on \((F,+)\) of order 6 compatible with a multiplication making \(F\setminus\{0\}\) a group of order 5 under an operation distributing over an order-6 additive group, but \((F,+)\) must be an elementary abelian \(p\)-group for a single prime \(p\) (Step 1), and \(6=2\cdot3\) is not a prime power, so the construction is impossible from the outset.
Drop finiteness (allow infinite fields of a given cardinality): \(\mathbb{Q}(i)\) and \(\mathbb{Q}(\sqrt2)\) both have cardinality \(\aleph_0\) but are not isomorphic, since \(x^2+1=0\) has a solution in the first and not the second; uniqueness-by-size collapses completely once finiteness is removed.
Drop "prime" and use a prime power as the "characteristic": attempting to build "\(\mathbb{Z}/p^n\mathbb{Z}\) as the field of order \(p^n\)" fails because \(\mathbb{Z}/p^n\mathbb{Z}\) has zero divisors for \(n\gt1\) (e.g. in \(\mathbb{Z}/4\mathbb{Z}\), \(2\cdot2=0\)) — the correct field \(\mathbb{F}_{p^n}\) is a degree-\(n\) extension of \(\mathbb{F}_p\), not a quotient of \(\mathbb{Z}\).

Common errors

Believing \(\mathbb{F}_{p^n} = \mathbb{Z}/p^n\mathbb{Z}\) as rings; the two agree only when \(n=1\).
Treating "there is a field of order \(q\)" as sufficient without checking \(q\) is a prime power — e.g. incorrectly asserting a field of order \(2\cdot 3=6\) exists "since \(6\) is a positive integer".
Forgetting the "up to isomorphism" qualifier and being confused when two textbooks construct \(\mathbb{F}_4\) via different irreducible quadratics, thinking this contradicts uniqueness.
Conflating the additive group \((\mathbb{F}_{p^n},+) \cong (\mathbb{Z}/p\mathbb{Z})^n\) (elementary abelian) with the multiplicative group \(\mathbb{F}_{p^n}^\times\), which is cyclic of order \(p^n-1\) — these are different groups with different structure.
Misapplying the exponent in \(a^{q}=a\), e.g. writing \(a^{q-1}=a\) instead of \(a^{q-1}=1\) for \(a\ne0\), or forgetting the exception at \(a=0\).
Assuming every subfield of \(\mathbb{F}_{p^n}\) has order dividing \(n\) directly as an integer (\(p^m\) with \(m|n\)) but stating the divisibility condition on \(p^m\) itself rather than on the exponents \(m,n\).

Discussion

The classification of finite fields is a genuinely 19th/early-20th-century achievement: Galois's 1830 memoir on "imaginary" roots of congruences \(\bmod\ p\) essentially constructed \(\mathbb{F}_{p^n}\) as roots of \(x^{p^n}-x\) (hence the older name "Galois field", abbreviated \(\mathrm{GF}(q)\)), but the clean existence-and-uniqueness statement in the form given here is usually credited to E. H. Moore (1893), who proved that every finite field arises this way and that the isomorphism type depends only on the order.

The proof is a beautiful interplay of three separate ideas that each do real work: Lagrange's theorem supplies the identity \(a^q=a\) that characterises elements of a size-\(q\) field (Step 6); the Frobenius endomorphism supplies a mechanism for constructing a subfield "for free" out of a fixed-point set, without ever writing down field elements explicitly (Step 4); and the general existence/uniqueness machinery for splitting fields supplies the abstract nonsense that turns "same root set" into "isomorphic" (Steps 2, 8). None of the three can be dropped: the Lagrange step is what pins down uniqueness, the Frobenius step is what makes existence non-circular (it shows the roots of \(x^q-x\) really do close up into a field rather than merely a set), and the splitting-field machinery is what upgrades "same polynomial, same roots" into an actual isomorphism.

The theorem underlies essentially all of applied finite-field mathematics: Reed–Solomon and BCH error-correcting codes are built over \(\mathbb{F}_{2^m}\); AES's S-box arithmetic takes place in \(\mathbb{F}_{2^8}\); elliptic-curve cryptography is typically instantiated over \(\mathbb{F}_p\) or \(\mathbb{F}_{2^m}\). In every one of these applications, engineers implicitly rely on there being exactly one field of the relevant size, so that "the field \(\mathrm{GF}(256)\)" in a standards document is an unambiguous specification rather than a family of choices.

A common misconception worth flagging explicitly: students sometimes think the classification also pins down a canonical *construction* — e.g. "the" irreducible polynomial defining \(\mathbb{F}_{2^8}\) — but uniqueness is only up to isomorphism, and different irreducible polynomials of the same degree over \(\mathbb{F}_p\) give different-looking but isomorphic fields (AES, for instance, uses the specific reduction polynomial \(x^8+x^4+x^3+x+1\), a choice of convenience, not of necessity — any degree-8 irreducible over \(\mathbb{F}_2\) would define an isomorphic field).

Worked examples

\text{Exhibit the field of order } 4 \text{ and verify it matches the classification.}

Take \(q=4=2^2\), so \(p=2\), \(n=2\). We need an irreducible degree-2 polynomial over \(\mathbb{F}_2\): \(x^2+x+1\) has no root in \(\mathbb{F}_2\) (\(0^2+0+1=1\ne0\), \(1^2+1+1=1\ne0\)), so it is irreducible. A

L = \mathbb{F}_2[x]/(x^2+x+1) = \{0,1,\alpha,\alpha+1\}, \quad \alpha^2=\alpha+1.

Quotienting a polynomial ring by an irreducible polynomial of degree \(n\) over a field \(K\) yields a field extension of degree \(n\) (standard fact: the ideal is maximal since the ring is a PID and the polynomial is irreducible, so the quotient is a field); here \(|L|=2^2=4\) as vector-space dimension count (Step 1 of the main proof, run in reverse). A

\text{Check every element satisfies } a^{4}=a\ (\text{i.e. } L = R \text{ from Step 4/5 of the proof}).

\(0^4=0\), \(1^4=1\) trivially. \(\alpha^2=\alpha+1\), so \(\alpha^4=(\alpha^2)^2=(\alpha+1)^2=\alpha^2+1=(\alpha+1)+1=\alpha\) (using char 2, so \(2\alpha=0\)). For \(\beta=\alpha+1\): \(\beta^2=\alpha^2+1=\alpha\) so \(\beta^4=\alpha^2=\alpha+1=\beta\). All four elements are roots of \(x^4-x\), matching the classification's prediction that \(L\) is exactly the root set. B

\mathbb{F}_2[x]/(x^2+x+1) \text{ is a/the field of order } 4, \text{ unique up to isomorphism.}

Reading. Any other construction of a size-4 field — e.g. using the other irreducible quadratic (there is in fact only one over \(\mathbb{F}_2\)) or an abstract splitting field of \(x^4-x\) — gives an isomorphic field, consistent with the theorem.

\text{Determine every subfield of } \mathbb{F}_{2^{12}} \text{ and its order.}

By the subfield criterion corollary (itself a consequence of this classification), the subfields of \(\mathbb{F}_{p^n}\) correspond exactly to divisors \(m\) of \(n\), each contributing a unique subfield \(\mathbb{F}_{p^m}\). A

\text{Divisors of } 12: \ 1,2,3,4,6,12.

Elementary number theory: list all positive integers dividing \(12=2^2\cdot3\). A

\text{Subfields: } \mathbb{F}_{2^1}=\mathbb{F}_2,\ \mathbb{F}_{2^2}=\mathbb{F}_4,\ \mathbb{F}_{2^3}=\mathbb{F}_8,\ \mathbb{F}_{2^4}=\mathbb{F}_{16},\ \mathbb{F}_{2^6}=\mathbb{F}_{64},\ \mathbb{F}_{2^{12}} \text{ itself.}

Each divisor \(m\) of \(12\) gives exactly one subfield of order \(2^m\), by the corollary; by the uniqueness half of the classification theorem each of these is unambiguously "the" field of that order, so there is no double-counting or ambiguity in the list. B

\mathbb{F}_{2^{12}} \text{ has exactly six subfields, of orders } 2,4,8,16,64,4096.

Reading. The lattice of subfields of \(\mathbb{F}_{2^{12}}\) is isomorphic to the divisor lattice of \(12\), a direct structural payoff of knowing there is exactly one field of each relevant order.

Problems

Explain briefly why there is no field with exactly 15 elements.
Solution
By the classification theorem, every finite field has order \(p^n\) for a prime \(p\). Since \(15 = 3\times5\) is a product of two distinct primes, it is not a prime power, so no field of order 15 exists.
Verify directly (without citing the theorem) that every nonzero element of \(\mathbb{F}_5\) satisfies \(a^4=1\), and explain how this instance relates to Step 6 of the proof.
Solution
\(1^4=1\), \(2^4=16\equiv1\), \(3^4=81\equiv1\), \(4^4=256\equiv1\) (all mod 5). This is Lagrange's theorem applied to \(\mathbb{F}_5^\times\), a group of order \(5-1=4\): every element's order divides 4, so \(a^4=1\) for all \(a\in\mathbb{F}_5^\times\). This is exactly the mechanism of Step 6, with \(q=5\), \(q-1=4\).
How many elements does \(\mathbb{F}_{81}\) have that do *not* lie in any proper subfield?
Solution
\(81=3^4\), so \(\mathbb{F}_{81}=\mathbb{F}_{3^4}\); by the subfield criterion its proper subfields correspond to proper divisors of 4, namely 1 and 2, giving subfields \(\mathbb{F}_3\) (3 elements) and \(\mathbb{F}_9\) (9 elements), with \(\mathbb{F}_3\subset\mathbb{F}_9\subset\mathbb{F}_{81}\). By inclusion–exclusion the elements lying in some proper subfield are exactly those of \(\mathbb{F}_9\) (the largest proper subfield, which contains \(\mathbb{F}_3\)), i.e. 9 elements. So the elements outside every proper subfield number \(81-9=72\).
Two students each construct "the field of order 8": one uses \(\mathbb{F}_2[x]/(x^3+x+1)\), the other uses \(\mathbb{F}_2[x]/(x^3+x^2+1)\) (both irreducible cubics over \(\mathbb{F}_2\)). Are these the same field? Justify using the theorem.
Solution
They are isomorphic, though not literally identical as sets of formal expressions. Both are degree-3 extensions of \(\mathbb{F}_2\) with \(2^3=8\) elements, so by the uniqueness half of the classification theorem (Steps 7–8 of the proof: any field of order \(q\) is a splitting field of \(x^q-x\) over \(\mathbb{F}_p\), and splitting fields of the same polynomial over the same base are isomorphic) both quotient rings are isomorphic to \(\mathbb{F}_8\), hence to each other. An explicit isomorphism sends a root of the first cubic to a suitable root of the second.
Prove that if \(F\) is a finite field of characteristic \(p\), the map \(\sigma: F \to F\), \(\sigma(a) = a^p\), is an automorphism of \(F\), and identify \([F:\mathbb{F}_p]\) in terms of the smallest \(k\ge1\) with \(\sigma^k = \mathrm{id}\).
Solution
\(\sigma\) is a ring homomorphism by the freshman's dream identities \((a+b)^p=a^p+b^p\) and \((ab)^p=a^pb^p\) in characteristic \(p\) (used in Step 4 of the main proof). A ring homomorphism from a field is injective (trivial kernel, as the kernel is a proper ideal of a field, hence \(\{0\}\)), and an injective self-map of a finite set is bijective, so \(\sigma\) is an automorphism (this is exactly the Frobenius argument of Step 4). If \(|F|=p^n\), then by Step 6, \(a^{p^n}=a\) for all \(a\in F\), i.e. \(\sigma^n=\mathrm{id}\); and \(n\) is the smallest such exponent because \(x^{p^k}-x\) can have at most \(p^k\) roots, which is fewer than \(|F|=p^n\) whenever \(k\lt n\), so \(\sigma^k\neq\mathrm{id}\) for \(k\lt n\). Hence the smallest such \(k\) equals \(n=[F:\mathbb{F}_p]\).