Algebra

Galois theory

Links field extensions to groups of symmetries, explaining why some equations have no formula for their roots.

IntuitionFrom solving equations to the symmetry of roots

Every student knows the quadratic formula: $x^2+px+q=0$ has roots $x=\dfrac{-p\pm\sqrt{p^2-4q}}{2}$ . The two roots swap places when we flip the $\pm$ sign — that swap is itself a symmetry. Galois's key idea was to attach to every polynomial equation a group of permutations of its roots that preserve every algebraic relation between them, and the structure of this group decides exactly how "hard" the equation is to solve by radicals.

Rotating by

\theta=90°

multiplies a point by

i

— exactly how the generator

\sigma

\mathrm{Gal}(L/\mathbb{Q})

acts on the root

\alpha=\sqrt[4]{2}

x^4-2=0

, cycling the four roots.

SchoolBridge from high-school algebra: Vieta and Cardano

Vieta's formulas state that the roots $x_1,x_2$ of $x^2+px+q=0$ satisfy $x_1+x_2=-p$ and $x_1x_2=q$ — symmetric expressions in the roots, unchanged when $x_1\leftrightarrow x_2$ . Cardano found a similar radical formula for cubics; Ferrari did the same for quartics. But every attempt at a quintic formula failed. Abel (1824) proved no general radical formula exists for degree $5$ ; Galois (1832) explained exactly why, through the language of groups.

UndergraduateField extensions and the Galois group

Definition: Field extension, Galois extension

Given fields $K\subseteq L$ , we call $L/K$ a field extension. It is finite if $L$ is a finite-dimensional $K$ -vector space, and its degree $[L:K]$ is that dimension. $L/K$ is Galois if it is normal (every irreducible polynomial over $K$ with one root in $L$ has all its roots in $L$ ) and separable (no irreducible factor has repeated roots) — automatic whenever $K$ has characteristic $0$ , e.g. $K=\mathbb{Q}$ .

\mathrm{Gal}(L/K)=\{\sigma:L\xrightarrow{\sim}L \mid \sigma(a)=a\ \forall a\in K\}

$\mathrm{Gal}(L/K)$ is the set of all field automorphisms of $L$ that fix every element of $K$ , with composition as the group operation. When $L/K$ is a finite Galois extension, this is a finite group whose size is controlled precisely by the degree of the extension.

|\mathrm{Gal}(L/K)|=[L:K]

The degree of the field extension equals the order of the Galois group exactly — a direct bridge between linear algebra (dimension of a vector space) and group theory (size of a permutation group of the roots).

Solvability by radicals of the general degree-n equation
Degree n	Generic Galois group	Solvable by radicals?
2	$\mathbb{Z}/2\mathbb{Z}$	Yes (quadratic formula)
3	$S_3$	Yes (Cardano)
4	$S_4$	Yes (Ferrari)
5	$S_5$	No (Abel–Ruffini: $S_5$ is not solvable)

Theorem: Fundamental Theorem of Galois Theory

Let $L/K$ be a finite Galois extension with $G=\mathrm{Gal}(L/K)$ . The map $H\mapsto L^H$ (the field fixed by $H$ ) is an inclusion-reversing bijection between subgroups $H\le G$ and intermediate fields $K\subseteq F\subseteq L$ , with inverse $F\mapsto\mathrm{Gal}(L/F)$ . Moreover $[L:F]=|\mathrm{Gal}(L/F)|$ , $[F:K]=[G:\mathrm{Gal}(L/F)]$ , and $F/K$ is Galois iff $\mathrm{Gal}(L/F)\trianglelefteq G$ , in which case $\mathrm{Gal}(F/K)\cong G/\mathrm{Gal}(L/F)$ .

Why is it true?

The theorem turns questions about fields (infinite, hard-to-enumerate algebraic objects) into questions about a finite group's subgroup lattice — every question about intermediate fields (how many, which contains which, which are Galois over $K$ ) is answered by staring at the subgroups of $G$ instead.

Proof

Step 1 (Artin's lemma gives $L^{\mathrm{Gal}(L/F)}=F$ ). Let $F$ be an intermediate field, $H=\mathrm{Gal}(L/F)$ . Clearly $F\subseteq L^H$ since every $\sigma\in H$ fixes $F$ by definition. For the reverse inclusion, use Artin's theorem: if $H$ is a finite group of automorphisms of $L$ then $[L:L^H]=|H|$ ; this follows from Dedekind's lemma that distinct field automorphisms are linearly independent as functions $L\to L$ , which forces $[L:L^H]\ge|H|$ . Since $L/F$ is Galois, $[L:F]=|\mathrm{Gal}(L/F)|=|H|$ , and combined with $F\subseteq L^H$ , $[L:L^H]=|H|=[L:F]$ we get $F=L^H$ .

Step 2 (the two maps are mutually inverse). Given any subgroup $H\le G$ , set $F=L^H$ ; we must show $\mathrm{Gal}(L/F)=H$ . By definition $H\subseteq\mathrm{Gal}(L/F)$ (every element of $H$ fixes $L^H=F$ ). Artin's theorem applied to $H$ gives $[L:F]=[L:L^H]=|H|$ . Applying it again to $\mathrm{Gal}(L/F)$ (always valid since $L/F$ is automatically Galois) gives $|\mathrm{Gal}(L/F)|=[L:F]=|H|$ . Since $H\subseteq\mathrm{Gal}(L/F)$ and both have the same finite size $|H|$ , we get $H=\mathrm{Gal}(L/F)$ .

Step 3 (order-reversing). Directly from the definition of fixed field, $H_1\subseteq H_2\Rightarrow L^{H_1}\supseteq L^{H_2}$ , so the bijection reverses inclusions in both directions.

Step 4 (degree formulas). We already showed $[L:F]=|\mathrm{Gal}(L/F)|=|H|$ . From the tower formula $[L:K]=[L:F][F:K]$ and $[L:K]=|G|$ , we get $[F:K]=|G|/|H|=[G:H]$ .

Step 5 (normal subgroups correspond to Galois subextensions). For $\sigma\in G$ , direct verification gives $\sigma(L^H)=L^{\sigma H\sigma^{-1}}$ : indeed $x\in L^H\iff\forall h\in H,\ hx=x\iff\forall h\in H,\ (\sigma h\sigma^{-1})(\sigma x)=\sigma x\iff \sigma x\in L^{\sigma H\sigma^{-1}}$ . So $F=L^H$ is stable under every $\sigma\in G$ (which is exactly the normality condition that makes $F/K$ Galois, since $F$ is generated by roots of polynomials over $K$ on which $G$ acts transitively) if and only if $\sigma H\sigma^{-1}=H$ for all $\sigma$ , i.e. $H\trianglelefteq G$ . In that case restriction $\sigma\mapsto\sigma|_F$ gives a surjective homomorphism $G\to\mathrm{Gal}(F/K)$ with kernel exactly $H$ , so $\mathrm{Gal}(F/K)\cong G/H$ by the first isomorphism theorem.

Worked example: the Galois group of $x^4-2$

Consider $x^4-2=0$ , irreducible over $\mathbb{Q}$ by Eisenstein's criterion at $p=2$ . Its four complex roots are $\alpha=\sqrt[4]{2},\ i\alpha,\ -\alpha,\ -i\alpha$ , where $\alpha=\sqrt[4]{2}>0$ is the real positive fourth root. The splitting field is $L=\mathbb{Q}(\sqrt[4]{2},\,i)$ : we need both $\alpha$ (for one root) and $i$ (to generate the other three from it).

Since $[\mathbb{Q}(\alpha):\mathbb{Q}]=4$ (degree- $4$ irreducible) and $[\mathbb{Q}(\alpha,i):\mathbb{Q}(\alpha)]=2$ (as $i\notin\mathbb{Q}(\alpha)\subset\mathbb{R}$ ), we get $|\mathrm{Gal}(L/\mathbb{Q})|=[L:\mathbb{Q}]=8$ . This group is generated by $\sigma,\tau$ with $\sigma(\alpha)=i\alpha,\ \sigma(i)=i,\qquad \tau(\alpha)=\alpha,\ \tau(i)=-i$ ( $\sigma$ cycles the four roots, $\tau$ is complex conjugation), satisfying $\sigma^4=\tau^2=\mathrm{id}$ , $\tau\sigma\tau^{-1}=\sigma^{-1}$ — exactly the dihedral group of the square with vertices at the four roots, so $\mathrm{Gal}(L/\mathbb{Q})\cong D_4$ .

$D_4$ has exactly $10$ subgroups. By the Fundamental Theorem, each corresponds to exactly one intermediate field: for instance $\langle\tau\rangle$ (order $2$ ) fixes $L^{\langle\tau\rangle}=\mathbb{Q}(\alpha)$ (degree $4=[G:\langle\tau\rangle]$ over $\mathbb{Q}$ ), while $\langle\sigma\rangle$ (order $4$ , normal since index $2$ ) fixes $L^{\langle\sigma\rangle}=\mathbb{Q}(i)$ (degree $2$ , and $\mathbb{Q}(i)/\mathbb{Q}$ is indeed Galois since $\langle\sigma\rangle\trianglelefteq D_4$ , matching the familiar fact that $\mathbb{Q}(i)/\mathbb{Q}$ is a normal quadratic extension).

Theorem: Transitivity of the Galois group on roots

If $f\in K[x]$ is irreducible over $K$ (characteristic $0$ ) and $L$ is its splitting field over $K$ , then $\mathrm{Gal}(L/K)$ , acting on the set $R$ of roots of $f$ in $L$ by permutation, acts transitively: for any $r_1,r_2\in R$ there is $\sigma\in\mathrm{Gal}(L/K)$ with $\sigma(r_1)=r_2$ .

Why is it true?

This is why we can speak of "the Galois group of a polynomial" and not just "of a field extension": it explains why every root of an irreducible polynomial is algebraically indistinguishable from every other — there is always a symmetry of $L$ carrying one root to the other.

Proof

Step 1: Since $f$ is irreducible over $K$ and $r_1,r_2\in R\subset L$ are both roots, there is a $K$ -isomorphism $\varphi:K(r_1)\to K(r_2)$ with $\varphi(r_1)=r_2$ , $\varphi|_K=\mathrm{id}_K$ — the basic property of minimal polynomials: $K(r_1)\cong K[x]/(f)\cong K(r_2)$ via the isomorphism sending $r_1\mapsto x\mapsto r_2$ .

Step 2: $L$ is a splitting field of $f$ over both $K(r_1)$ and $K(r_2)$ (since $L$ is a splitting field over $K$ , and $K\subseteq K(r_i)\subseteq L$ ). By the isomorphism extension theorem for splitting fields, $\varphi$ extends to a field isomorphism $\sigma:L\to L$ .

Step 3: Since $\sigma|_K=\varphi|_K=\mathrm{id}_K$ , we have $\sigma\in\mathrm{Gal}(L/K)$ , and $\sigma(r_1)=\varphi(r_1)=r_2$ . So for any two roots $r_1,r_2$ there is always some $\sigma$ sending one to the other — precisely the definition of transitivity.

UndergraduateReal-World Applications and Worked Examples

Though born to answer a purely theoretical question ("does the general quintic have a radical formula?"), Galois theory became foundational for modern cryptography, error-correcting codes, and deciding what can and cannot be built with straightedge and compass.

Example: Finite fields in AES encryption

The AES cipher operates on bytes, each viewed as an element of the finite field $\mathbb{F}_{2^8}=\mathbb{F}_2[x]/(x^8+x^4+x^3+x+1)$ — a degree- $8$ Galois extension of $\mathbb{F}_2$ . Explain why multiplicative inverses (used in the SubBytes step) always exist and are unique for every nonzero byte, and why this fails if the modulus were a reducible polynomial like $x^8+1=(x+1)^8$ over $\mathbb{F}_2$ .

Solution

Step 1: $\mathbb{F}_2[x]/(m(x))$ is a field (not merely a ring) exactly when $m(x)$ is irreducible over $\mathbb{F}_2$ — this is the condition for $L/\mathbb{F}_2$ to be a finite field extension (automatically Galois: separable since Frobenius $x\mapsto x^2$ is an automorphism, and normal since $\mathbb{F}_{2^n}$ is always the splitting field of $x^{2^n}-x$ ).

Step 2: AES chose $m(x)=x^8+x^4+x^3+x+1$ , which is irreducible over $\mathbb{F}_2$ (it has no root in $\mathbb{F}_2$ and no factorization into degree- $4\times4$ or $2\times6$ pairs over $\mathbb{F}_2$ ), so the quotient is a field with $2^8=256$ elements — every nonzero element is invertible, computed efficiently by the extended Euclidean algorithm on $\mathbb{F}_2[x]$ .

Step 3: If $m(x)$ were replaced by a reducible polynomial such as $x^8+1=(x+1)^8$ over $\mathbb{F}_2$ (characteristic $2$ ), the quotient $\mathbb{F}_2[x]/(x^8+1)$ is no longer a field: the nonzero element $x+1$ satisfies $(x+1)^8\equiv 0$ , making it a nilpotent zero-divisor with no multiplicative inverse. SubBytes would be undefined on such bytes, breaking the whole cipher — which is exactly why cryptographic standards must verify irreducibility of the modulus polynomial (e.g. via Berlekamp's algorithm, itself built on Galois theory) before publication.

Example: Why the regular heptagon cannot be constructed with straightedge and compass

Ancient Greeks could construct a regular pentagon with straightedge and compass but never a regular heptagon ( $n=7$ ), despite 2000 years of attempts. Use Galois theory to explain exactly why.

Solution

Step 1: The vertices of a regular $n$ -gon correspond to the $n$ -th roots of unity, and constructing it is equivalent to constructing $\zeta_n=e^{2\pi i/n}$ from $\mathbb{Q}$ using only straightedge-and-compass steps. Gauss and Wantzel proved: $\zeta_n$ is constructible iff $[\mathbb{Q}(\zeta_n):\mathbb{Q}]$ is a power of $2$ , because every elementary construction step (intersecting lines/circles) adjoins only a degree- $1$ or degree- $2$ extension, so any constructible point sits atop a tower of $\mathbb{Q}$ with degree a power of $2$ ; conversely a degree- $2^k$ Galois group is a $2$ -group, hence solvable with an index- $2$ subgroup chain, which by the Fundamental Theorem corresponds to a tower of degree- $2$ field steps, each realizable by straightedge and compass.

Step 2: The minimal polynomial of $\zeta_7$ over $\mathbb{Q}$ is the $7$ th cyclotomic polynomial $x^6+x^5+x^4+x^3+x^2+x+1=0$ (degree $6$ , since $7$ is prime all $6$ primitive roots share this minimal polynomial), so $[\mathbb{Q}(\zeta_7):\mathbb{Q}]=6$ .

Step 3: $6=2\times3$ is not a power of $2$ (it has an odd factor $3$ ), so by the Gauss–Wantzel criterion the regular heptagon is NOT constructible with straightedge and compass — no amount of cleverness could have found a construction, which is exactly why 2000 years of attempts failed. (Contrast: the regular pentagon has $[\mathbb{Q}(\zeta_5):\mathbb{Q}]=4=2^2$ , a power of $2$ , so it IS constructible, matching Euclid's construction in the Elements.)

What is $|\mathrm{Gal}(L/K)|$ for a finite Galois extension $L/K$ ?

What is $\mathrm{Gal}(L/\mathbb{Q})$ for $L=\mathbb{Q}(\sqrt[4]{2},i)$ , the splitting field of $x^4-2=0$ ?

Why is the regular heptagon not constructible with straightedge and compass?

Why must the modulus polynomial for the AES finite field $\mathbb{F}_{2^8}$ be irreducible over $\mathbb{F}_2$ ?

References

Ian Stewart (2015). Galois Theory (4th ed.) · DOI:10.1201/b18187
David S. Dummit, Richard M. Foote (2004). Abstract Algebra (3rd ed.)