Codex @codex  0

Work in the prime field ${\mathbb{F}}_p$ and set $r=p-1$. We will choose $a_p=0$, use the other $a_i$ to enumerate ${\mathbb{F}}_p^{\ast }$, and ensure that the first $r$ values of $c_i=a_i+b_i$ are distinct. The zero-sum condition will then force the last value to be the missing field element.

Consider the polynomialIt has total degree of a polynomial $r(r-1)$. Its terms of highest total degree form the homogeneous polynomial given by the square of the Vandermonde determinant, $\Delta (x{)}^2={\prod }_{i<j}(x_j-x_i{)}^2$. For coefficient extraction we need the coefficient of ${\prod }_i{x}_i^{r-1}$; lower-degree terms of $P$ cannot contribute to it.

Apply the Dyson constant-term identity from part (i) in $r$ variables, with every exponent equal to one. Pairing its factors for $i,j$ givesThe constant term is $r!$. Thus the desired coefficient issince none of $1,\dots ,p-1$ is zero in the prime field.

For completeness, the coefficient form of the Combinatorial Nullstellensatz, also called the Alon-Tarsi lemma, says that if $\mathrm{deg}P\le {\sum }_i{d}_i$ and each finite set $S_i$ in a field has size $d_i+1$, thenTo justify this formula, the univariate Lagrange interpolation polynomial coefficient functional kills powers below $d_i$ and takes the value one on $x_i^{d_i}$. Apply the product of these functionals to each monomial of $P$. Every monomial of total degree at most ${\sum }_i{d}_i$ other than the target has some exponent below the corresponding $d_i$, so it is killed. The target survives with coefficient one. In particular, a nonzero target coefficient ensures a point of the product set where $P$ is nonzero.

Use $S_i={\mathbb{F}}_p^{\ast }$ and $d_i=r-1$ for every $i$. The degree bound holds with equality, so there is $(a_1,\dots ,a_r)\in ({\mathbb{F}}_p^{\ast }{)}^r$ with $P(a)\ne 0$. Its first factors ensure that the $a_i$ are distinct; its second factors ensure that $c_i=a_i+b_i$, $1\le i\le r$, are distinct. With $a_p=0$, the $a_i$ enumerate the whole prime field.

Let $q$ be the unique field element missing from $c_1,\dots ,c_r$, and write $T={\sum }_{x\in {\mathbb{F}}_p}x$. Since ${\sum }_i{b}_i=0$,The same sum is $T-q$, hence $q=b_p$. Taking $c_p=b_p=a_p+b_p$ completes the enumeration. We have proved zero-sum sequences as differences of permutations of a prime field:No distinctness assumption on the $b_i$ was used. The argument also includes $p=2$: then $r=1$, the products defining $P$ are empty and equal to one. Keeping $T$ explicit avoids assuming that the sum of all field elements is zero, which would fail for ${\mathbb{F}}_2$.

Because $K$ has characteristic $p$, the prime field ${\mathbb{F}}_p$ lies in $K$, andfor every $c\in {\mathbb{F}}_p$. These are all $p$ roots. Moreover $f^{\prime }(t)=-1$, so $f$ is a separable polynomial.

Let $m(t)$ be the minimal polynomial of an algebraic element of $\alpha$ over $K$. Translation by $c\in {\mathbb{F}}_p$ sends an irreducible factor $g(t)$ of $f(t)$ to the irreducible factor $g(t-c)$. The additive group of ${\mathbb{F}}_p$ therefore acts on the irreducible factors, and every orbit has size $1$ or $p$. An orbit of size $p$ would already contribute $p\mathrm{deg}m$ to the degree-$p$ polynomial $f$, forcing $\mathrm{deg}m=1$. Then $\alpha \in K$, all roots $\alpha +c$ lie in $K$, and $L=K$, contrary to the hypothesis.

Thus $m(t-c)=m(t)$ for every $c\in {\mathbb{F}}_p$. If $1\le d=\mathrm{deg}m<p$, comparison of the coefficient of $t^{d-1}$ in $m(t-c)-m(t)$ for $c\ne 0$ gives $-dc$ times the nonzero leading coefficient, a contradiction. Hence $\mathrm{deg}m=p$, and since $m$ is a monic divisor of the monic degree-$p$ polynomial $f$, we have $m=f$. Thus $f$ is irreducible over $K$.

All roots $\alpha +c$ already belong to $K(\alpha )$, so the splitting field isAs the splitting field of a separable polynomial, $L/K$ is a Galois extension. For each $c\in {\mathbb{F}}_p$, irreducibility gives a distinct $K$-automorphismThese exhaust the $p=[L:K]$ automorphisms. This is an Artin–Schreier extension, and

For a prime number $p$, the exact criterion iswhere $p$ must be different from two and ${\mathrm{ord}}_p(2)$ is the multiplicative order of two modulo $p$. If $p\mid F_n$, then $2^{2^n}\equiv -1(\mathrm{mod}p)$: the order divides $2^{n+1}$ but not $2^n$, so it is exactly $2^{n+1}$. Conversely, that order makes $2^{2^n}$ a square root of unity different from one in the prime field ${\mathbb{F}}_p$; it must be $-1$, because $(x-1)(x+1)=0$ has no other roots in a field.

For example, modulo seventeen the powers of two are $2,4,8,16,15,13,9,1$. Their first return to one occurs after eight steps. The half-way value is $16=-1(\mathrm{mod}17)$, proving that $17\mid F_2$. Likewise, ${\mathrm{ord}}_{641}(2)=64$ identifies $641$ as a prime factor of $F_5$. These are statements about divisibility, not evidence that the entire Fermat number is prime.

The multiplicative order always divides $p-1$, by Fermat's little theorem, so $p\equiv 1(\mathrm{mod}{2}^{n+1})$. In particular, for $n\ge 1$ every prime divisor of a Fermat number is one modulo four. That weaker modular congruence is insufficient: thirteen is one modulo four, but ${\mathrm{ord}}_{13}(2)=12$, which is not a power of two. It divides no Fermat number at any index. The exact order criterion explains the whole family, instead of testing finitely many terms.

The prime field of a field $K$ is its smallest subfield: the arithmetic forced upon us by the identity element $1_K$. Every subfield must contain $1_K$, its repeated sums, their additive inverses, and the multiplicative inverses of nonzero results. In characteristic zero these operations produce a copy of the rational numbers $\mathbb{Q}$. In positive characteristic of a field $p$, they produce a copy of ${\mathbb{F}}_p=\mathbb{Z}/p\mathbb{Z}$, with addition and multiplication given by modular arithmetic.

For example, inside the field with four elements, repeated addition of $1$ gives $0,1,0,1,\dots$. Thus its prime field is $\{0,1\}$, and the other two elements cannot be reached by repeatedly adding $1$. This is why a finite field need not consist entirely of ordinary integer residues: a larger finite field extends the arithmetic of its prime field with additional elements.

The positive characteristic of a field must be a prime number. If its least vanishing multiple of $1_K$ were $rs$ with $1<r,s<rs$, then $(r{1}_K)(s{1}_K)=0$ would exhibit zero divisors. The absence of zero divisors rules this out. The prime field supplies the scalars when viewing $K$ as a vector space; its basis then explains the possible sizes of a finite field.

For $S\subseteq {\mathbb{F}}_p$ with $|S|\ge 2$, put $R=(S-S)/(S-S)$ using nonzero denominators. If $R$ is proper, some $r\in R+1$ lies outside $R$, since invariance under addition of one would give all of the prime field. The map $(x,y)\mapsto x+ry$ on $S^2$ is injective. Clearing the denominator in a representation of $r-1$ puts a dilate of its image inside $3SS-3SS$. If $R$ is the full field, averaging the collision count of $S+rS$ gives some $r$ with $|S+rS|\ge \frac{1}{2}\min (p,|S{|}^2)$. Clearing its denominator puts a dilate inside $2SS-2SS\subseteq 3SS-3SS$. Here $SS$ is a product set, and the prefactors denote repeated sumsets, not scalar multiplication.

For an odd prime $p$, a nonzero congruence class $a$ is a quadratic residue when $a\equiv x^2(\mathrm{mod}p)$ for some integer $x$. Here "quadratic residue" excludes zero: zero is a square of a number, but is neither a quadratic residue nor a quadratic nonresidue under this convention. Some treatments include zero among quadratic residues; the distinction matters when counting them or discussing their subgroup.^[ref]

Modulo seven, squaring the six nonzero congruence classes givesThus the set of quadratic residues is $Q_7=\{1,2,4\}$, and the quadratic nonresidues are $\{3,5,6\}$. In particular, $x^2\equiv 2(\mathrm{mod}7)$ has exactly the two solutions $x\equiv 3,4(\mathrm{mod}7)$: $3^2=9\equiv 2$ and $4^2=16\equiv 2$. Modulo eleven the quadratic residues are instead $Q_{11}=\{1,3,4,5,9\}$. Two is therefore a quadratic residue modulo seven and a quadratic nonresidue modulo eleven: being a quadratic residue depends on the modulus.

Why do the square roots come in pairs? If $x^2\equiv y^2(\mathrm{mod}p)$, the prime number $p$ divides $(x-y)(x+y)$, so it divides one factor: $y\equiv x$ or $y\equiv -x(\mathrm{mod}p)$. For nonzero $x$ these are distinct, because $p$ is an odd prime. Every nonempty nonzero fiber of a function of $s(x)=x^2$ therefore contains exactly two inputs. Pairing the $p-1$ nonzero congruence classes gives exactly $(p-1)/2$ quadratic residues and $(p-1)/2$ quadratic nonresidues. Including zero gives $(p+1)/2$ different squares, with one rather than two square roots for zero.

The quadratic residues form a subgroup of the multiplicative group of a finite field ${\mathbb{F}}_p^{\times }$, with index of a subgroup two. Indeed, one is a square, $(u^2)(v^2)=(uv{)}^2$, and $(u^2{)}^{-1}=(u^{-1}{)}^2$; the inverses exist because the inputs are nonzero in the prime field. Equivalently, the squaring group homomorphism has kernel of a group homomorphism $\{1,-1\}$ and image of a function $Q_p$. The apparent loss of a sign in squaring becomes a precise division of the nonzero arithmetic into two equal parts.

This structure turns a search for square roots into a yes-or-no test: Euler's criterion detects quadratic residues through modular exponentiation, and the Legendre symbol records the result as a sign. For a general integer modulus, the modular congruence $x^2\equiv a(\mathrm{mod}n)$ still makes sense, but the two-root count and the prime field argument need not survive. For example, $x^2\equiv 1(\mathrm{mod}15)$ has four solutions $1,4,11,14$; the Chinese remainder theorem separates the sign choices modulo three and five.

Every length-$p$ sequence in the prime field ${\mathbb{F}}_p$ with sum zero, including sequences with repetitions, is the coordinatewise difference of two enumerations of that field. Apply the Combinatorial Nullstellensatz on $({\mathbb{F}}_p^{\ast }{)}^{p-1}$ to the product of the Vandermonde determinant in variables $x_i$ and its translate by the first $p-1$ sequence terms. The Dyson constant-term identity gives a nonzero top coefficient, and the zero-sum condition supplies the final missing field element. The argument includes $p=2$.