Cyclotomic Extensions

Which regular polygons can be built with only a compass and straightedge? Why does the answer hinge on the arithmetic of the number 17? Both questions are governed by a single family of field extensions. These are generated by roots of unity, called cyclotomic extensions. They form the cleanest, most computable nontrivial family in all of Galois Theory. Their Galois groups are always abelian, described explicitly by modular arithmetic. Their minimal polynomials — the cyclotomic polynomials — are among the most intensely studied objects in number theory. The idea is deceptively simple. Fix a positive integer nn and adjoin to Q\mathbb{Q} a primitive nn-th root of unity ζn=e2πi/n\zeta_n = e^{2\pi i/n}. The resulting field Q(ζn)\mathbb{Q}(\zeta_n) turns out to have degree φ(n)\varphi(n) over Q\mathbb{Q}. Here φ\varphi is Euler's totient function. Its Galois group is isomorphic to the group of units (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times. This single computation packages together facts about symmetry of the complex plane. It also covers factorization of integer polynomials, and structure of finite abelian groups. The big picture is that cyclotomic extensions are the "abelian building blocks" of number fields. The Kronecker–Weber theorem is a much deeper result, beyond this article's scope. It says every abelian extension of Q\mathbb{Q} sits inside some Q(ζn)\mathbb{Q}(\zeta_n). Even without that theorem, cyclotomic fields already give us something valuable. They are the first honest examples of Galois extensions with prescribed abelian Galois groups. They are also the arena in which Gauss proved his celebrated construction of the regular 17-gon. This article develops the cyclotomic polynomials Φn(x)\Phi_n(x) from scratch. It proves they are irreducible over Q\mathbb{Q}. It also establishes the isomorphism Gal(Q(ζn)/Q)≅(Z/nZ)×\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) \cong (\mathbb{Z}/n\mathbb{Z})^\times. Along the way we compute several examples completely, including n=12n=12 and n=20n=20. We show exactly where the argument needs the base field to be Q\mathbb{Q}. More generally, this means a field of characteristic not dividing nn. We demonstrate this by exhibiting a positive-characteristic breakdown.

Key takeaways
  • The nn-th roots of unity form a cyclic group of order nn under multiplication in C\mathbb{C} (or any field with enough roots).
  • The nn-th cyclotomic polynomial Φn(x)\Phi_n(x) is the minimal polynomial over Q\mathbb{Q} of a primitive nn-th root of unity, and xn−1=∏d∣nΦd(x)x^n - 1 = \prod_{d\mid n} \Phi_d(x).
  • Φn(x)∈Z[x]\Phi_n(x) \in \mathbb{Z}[x] is irreducible over Q\mathbb{Q}, so [Q(ζn):Q]=φ(n)[\mathbb{Q}(\zeta_n):\mathbb{Q}] = \varphi(n).
  • Gal(Q(ζn)/Q)\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) is isomorphic to (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times, hence always abelian.
  • Subfields of Q(ζn)\mathbb{Q}(\zeta_n) correspond via the Galois correspondence to subgroups of (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times.
  • The irreducibility argument crucially uses that Q\mathbb{Q} has characteristic 00; over Fp\mathbb{F}_p with p∣np \mid n, cyclotomic polynomials can fail to even make sense as separable minimal polynomials.
  • Key idea: adjoining roots of unity turns "which roots map to which" into arithmetic mod nn, converting a Galois-theoretic question into a number-theoretic one.

Where this lives today

Cyclotomic fields are the backbone of algebraic number theory's study of abelian extensions, via the Kronecker–Weber theorem and class field theory. In cryptography, roots of unity and cyclotomic polynomials underlie the design of finite fields used in elliptic-curve and pairing-based cryptosystems, and cyclotomic rings Z[ζn]\mathbb{Z}[\zeta_n] are the foundation of modern lattice-based cryptography (e.g. Ring-LWE schemes central to post-quantum standards). In computer algebra and signal processing, the factorization xn−1=∏d∣nΦd(x)x^n-1 = \prod_{d\mid n}\Phi_d(x) underlies the number-theoretic transform, a finite-field analogue of the Fast Fourier Transform used for fast polynomial multiplication. In classical geometry, the theory answers precisely which regular nn-gons are constructible — those with n=2kp1⋯prn = 2^k p_1\cdots p_r for distinct Fermat primes pip_i — by translating constructibility into solvability of the tower of subfields of Q(ζn)\mathbb{Q}(\zeta_n) by successive square roots, a story continued under Constructible Numbers. The abelian, completely computable Galois group here also serves as the friendliest possible testing ground for the ideas behind Solvability by Radicals, since abelian Galois groups are automatically solvable.

:::quiz[What is φ(15)\varphi(15), and hence [Q(ζ15):Q][\mathbb{Q}(\zeta_{15}):\mathbb{Q}]?]

  • 8 ✓
  • 15
  • 4
  • 12

Ask the tutor: How does the cyclotomic Galois group computation change if we work over a finite field Fq\mathbb{F}_q instead of Q\mathbb{Q}?

DefinitionRoots of unity and cyclotomic fields

Let nn be a positive integer and let FF be a field whose characteristic does not divide nn. An element ζ∈F‾\zeta \in \overline{F} (an algebraic closure of FF) is an nn-th root of unity if ζn=1\zeta^n = 1. It is a primitive nn-th root of unity if in addition ζk≠1\zeta^k \neq 1 for every integer 0<k<n0 < k < n, equivalently if ζ\zeta has multiplicative order exactly nn. The set μn\mu_n of all nn-th roots of unity in F‾\overline{F} is the set of roots of xn−1x^n - 1; since char(F)∤n\mathrm{char}(F) \nmid n, the polynomial xn−1x^n-1 is separable (its derivative nxn−1nx^{n-1} shares no root with it), so ∣μn∣=n|\mu_n| = n exactly, and μn\mu_n is a cyclic group of order nn under multiplication. For F=QF = \mathbb{Q} we fix once and for all

ζn=e2πi/n∈C,\zeta_n = e^{2\pi i /n} \in \mathbb{C},

a specific primitive nn-th root of unity, and define the nn-th cyclotomic field to be

Q(ζn)=Q(ζn)⊆C,\mathbb{Q}(\zeta_n) = \mathbb{Q}(\zeta_n) \subseteq \mathbb{C},

the splitting field of xn−1x^n-1 over Q\mathbb{Q} (any primitive nn-th root of unity generates the same field, since all primitive nn-th roots of unity are powers ζnk\zeta_n^k with gcd⁡(k,n)=1\gcd(k,n)=1). The nn-th cyclotomic polynomial is

Φn(x)=∏1≤k≤ngcd⁡(k,n)=1(x−ζnk),\Phi_n(x) = \prod_{\substack{1 \le k \le n \\ \gcd(k,n)=1}} \bigl(x - \zeta_n^k\bigr),

the monic polynomial in C[x]\mathbb{C}[x] whose roots are exactly the primitive nn-th roots of unity, each with multiplicity one.

Intuition

Picture the nn-th roots of unity as nn equally spaced points on the unit circle. Multiplying by ζn\zeta_n rotates the whole picture by 2π/n2\pi/n. A Galois automorphism of Q(ζn)/Q\mathbb{Q}(\zeta_n)/\mathbb{Q} must send ζn\zeta_n to another root of its minimal polynomial, and since automorphisms preserve the algebraic relation "raised to the nn-th power gives 11", the image must again be a primitive nn-th root of unity — that is, ζnk\zeta_n^k for some kk coprime to nn. This is the entire content of the group isomorphism: an automorphism is completely determined by which power of ζn\zeta_n it sends ζn\zeta_n to, and only the exponents coprime to nn are allowed, exactly the elements of (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times. The cyclotomic polynomials arise from grouping the nn points on the circle by their exact order: a point of order dd (for d∣nd \mid n) is a root of Φd\Phi_d, and every nn-th root of unity has order some divisor dd of nn. Summing over divisors recovers all of xn−1x^n - 1. This divisor-sum structure is what makes Φn\Phi_n computable by simple polynomial division, one divisor at a time, and is illustrated below for n=12n=12.

Figure
The 12th roots of unity, grouped by exact order d∣12d \mid 12: red points have order 1212 (primitive, roots of Φ12\Phi_{12}), the rest have order 1,2,3,4,61,2,3,4,6
k=0 (d=1) k=1 (d=12) k=2 (d=6) k=3 (d=4) k=4 (d=3) k=5 (d=12) k=6 (d=2) k=7 (d=12) only k coprime to 12 (k=1,5,7,11) give primitive roots — deg Φ₁₂ = φ(12) = 4

Central theorems

TheoremStructure of cyclotomic fields

Let n≥1n \geq 1 be an integer. Then: 1. (Divisor factorization) In Z[x]\mathbb{Z}[x],

xn−1=∏d∣nΦd(x),x^n - 1 = \prod_{d \mid n} \Phi_d(x),

and each Φd(x)\Phi_d(x) has integer coefficients, is monic, and has degree φ(d)\varphi(d). 2. (Irreducibility) Φn(x)\Phi_n(x) is irreducible over Q\mathbb{Q}. Consequently Φn\Phi_n is the minimal polynomial of ζn\zeta_n over Q\mathbb{Q}, and

[Q(ζn):Q]=φ(n).[\mathbb{Q}(\zeta_n):\mathbb{Q}] = \varphi(n).

3. (Galois group) Q(ζn)/Q\mathbb{Q}(\zeta_n)/\mathbb{Q} is a Galois extension, and there is a group isomorphism

Gal(Q(ζn)/Q)  →  ∼    (Z/nZ)×,σ↦a where σ(ζn)=ζna.\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) \;\xrightarrow{\;\sim\;}\; (\mathbb{Z}/n\mathbb{Z})^\times, \qquad \sigma \mapsto a \text{ where } \sigma(\zeta_n) = \zeta_n^a.

In particular Gal(Q(ζn)/Q)\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) is abelian of order φ(n)\varphi(n).

Proof

Step 1: Divisor factorization and integrality. Every nn-th root of unity ζ\zeta has some order dd, and d∣nd \mid n because ζn=1\zeta^n=1 forces the order of ζ\zeta to divide nn (order-of-element divides any exponent annihilating it, a basic fact about cyclic groups). Conversely, an element of exact order dd for d∣nd \mid n is an nn-th root of unity. Since μn\mu_n (the full set of nn-th roots of unity, which has exactly nn elements as noted in the definition) is partitioned by exact order into the sets of primitive dd-th roots of unity for d∣nd \mid n, and xn−1=∏ζ∈μn(x−ζ)x^n-1 = \prod_{\zeta \in \mu_n}(x-\zeta) (as xn−1x^n-1 is monic, separable of degree nn, with all nn roots being exactly μn\mu_n), we get

xn−1=∏d∣n∏ζ primitive d-th root(x−ζ)=∏d∣nΦd(x).x^n - 1 = \prod_{d \mid n} \prod_{\zeta \text{ primitive } d\text{-th root}} (x-\zeta) = \prod_{d\mid n} \Phi_d(x).

The degree count deg⁡Φd=φ(d)\deg \Phi_d = \varphi(d) is immediate from the definition, since the number of primitive dd-th roots of unity is by definition φ(d)\varphi(d) (the number of kk with 1≤k≤d1\le k \le d, gcd⁡(k,d)=1\gcd(k,d)=1). Integrality of coefficients is proved by strong induction on nn. For n=1n=1, Φ1(x)=x−1∈Z[x]\Phi_1(x) = x-1 \in \mathbb{Z}[x]. Suppose Φd(x)∈Z[x]\Phi_d(x) \in \mathbb{Z}[x] for all d<nd < n with d∣nd \mid n. Write

xn−1=Φn(x)⋅g(x),g(x):=∏d∣nd<nΦd(x)∈Z[x]x^n - 1 = \Phi_n(x) \cdot g(x), \qquad g(x) := \prod_{\substack{d \mid n \\ d < n}} \Phi_d(x) \in \mathbb{Z}[x]

by the inductive hypothesis; gg is monic since each factor is monic. Both xn−1x^n-1 and g(x)g(x) lie in Z[x]\mathbb{Z}[x] and gg is monic, so polynomial division of xn−1x^n-1 by gg in Q[x]\mathbb{Q}[x] produces a quotient and remainder that automatically have integer coefficients (the standard division algorithm for a monic divisor never needs to divide by anything but 11, so if dividend and divisor are integral, quotient and remainder are integral). Since Φn(x)\Phi_n(x) is this quotient (with zero remainder, because xn−1=Φn(x)g(x)x^n-1 = \Phi_n(x) g(x) exactly in C[x]\mathbb{C}[x], hence in Q[x]\mathbb{Q}[x] by comparing the unique factorization), we conclude Φn(x)∈Z[x]\Phi_n(x) \in \mathbb{Z}[x].

Step 2: Irreducibility of Φn\Phi_n over Q\mathbb{Q}. Let f(x)∈Z[x]f(x) \in \mathbb{Z}[x] be the minimal polynomial of ζn\zeta_n over Q\mathbb{Q}; by Gauss's Lemma ff may be taken monic with integer coefficients, and f∣Φnf \mid \Phi_n in Z[x]\mathbb{Z}[x] since Φn(ζn)=0\Phi_n(\zeta_n)=0 (as ζn\zeta_n is itself a primitive nn-th root of unity) and Φn∈Z[x]\Phi_n \in \mathbb{Z}[x] is monic. Write Φn=f⋅h\Phi_n = f \cdot h with h∈Z[x]h \in \mathbb{Z}[x] monic. We must show hh is a unit, i.e. h=1h=1, i.e. every primitive nn-th root of unity is already a root of ff. It suffices to show: if ζ\zeta is any root of ff, and pp is a prime with p∤np \nmid n, then ζp\zeta^p is also a root of ff. Granting this, every primitive nn-th root of unity has the form ζnk\zeta_n^k with gcd⁡(k,n)=1\gcd(k,n)=1; writing k=p1p2⋯prk = p_1 p_2 \cdots p_r as a product of (not necessarily distinct) primes, none dividing nn (since gcd⁡(k,n)=1\gcd(k,n)=1), and applying the claim repeatedly starting from the root ζn\zeta_n of ff, we find ζnp1\zeta_n^{p_1} is a root of ff, then ζnp1p2\zeta_n^{p_1 p_2} is a root of ff, and so on, until ζnk\zeta_n^k is a root of ff. Hence every primitive nn-th root of unity is a root of ff; since f∣Φnf \mid \Phi_n and Φn\Phi_n has no repeated roots (its roots are simple, being a subset of the simple roots of xn−1x^n-1), and ff already accounts for all φ(n)\varphi(n) primitive roots, deg⁡f≥φ(n)=deg⁡Φn\deg f \geq \varphi(n) = \deg \Phi_n, forcing f=Φnf = \Phi_n (both monic of the same degree with f∣Φnf \mid \Phi_n). This proves Φn\Phi_n is irreducible. Proof of the claim. Suppose for contradiction ζ\zeta is a root of ff but ζp\zeta^p is not, for some prime p∤np \nmid n. Since ζp\zeta^p is a root of Φn=fh\Phi_n = f h (because ζp\zeta^p is again a primitive nn-th root of unity: if (ζp)m=1(\zeta^p)^m = 1 for m<nm<n then ζpm=1\zeta^{pm}=1, and since pp is invertible mod nn — as p∤np \nmid n means gcd⁡(p,n)=1\gcd(p,n)=1 — this would force a relation contradicting ζ\zeta having order exactly nn; more directly, the map ζ↦ζp\zeta \mapsto \zeta^p permutes μn\mu_n and preserves order because gcd⁡(p,n)=1\gcd(p,n)=1), we must have ζp\zeta^p a root of hh. So ζ\zeta is a root of h(xp)h(x^p). Since ff is the minimal polynomial of ζ\zeta, f(x)∣h(xp)f(x) \mid h(x^p) in Q[x]\mathbb{Q}[x], hence in Z[x]\mathbb{Z}[x] (both monic). Now reduce mod pp: let fˉ,hˉ∈Fp[x]\bar f, \bar h \in \mathbb{F}_p[x] denote reduction of coefficients. We have fˉ∣hˉ(xp)\bar f \mid \bar h(x^p) in Fp[x]\mathbb{F}_p[x]. But in Fp[x]\mathbb{F}_p[x], the Frobenius identity gives hˉ(xp)=hˉ(x)p\bar h(x^p) = \bar h(x)^p (since ap=aa^p = a for coefficients a∈Fpa \in \mathbb{F}_p, the Frobenius endomorphism a↦apa \mapsto a^p fixes Fp\mathbb{F}_p, so hˉ(x)p=∑(hˉixi)p=∑hˉipxip=∑hˉixip=hˉ(xp)\bar h(x)^p = \sum (\bar h_i x^i)^p = \sum \bar h_i^p x^{ip} = \sum \bar h_i x^{ip} = \bar h(x^p)). So fˉ∣hˉ(x)p\bar f \mid \bar h(x)^p. Let pˉ(x)\bar{p}(x) be an irreducible factor of fˉ\bar f in Fp[x]\mathbb{F}_p[x]; then pˉ∣hˉp\bar p \mid \bar h^p, and since pˉ\bar p is irreducible (hence prime in Fp[x]\mathbb{F}_p[x], a UFD), pˉ∣hˉ\bar p \mid \bar h. Therefore pˉ2∣fˉhˉ=fh‾=Φn‾=xn−1‾\bar p^2 \mid \bar f \bar h = \overline{fh} = \overline{\Phi_n} = \overline{x^n - 1}. But this means xn−1‾∈Fp[x]\overline{x^n-1} \in \mathbb{F}_p[x] has a repeated irreducible factor, i.e. xn−1x^n - 1 and its derivative nxn−1n x^{n-1} share a common factor mod pp. Since p∤np \nmid n, the image nˉ∈Fp×\bar n \in \mathbb{F}_p^\times is nonzero, so nxn−1n x^{n-1} has 00 as its only root, of multiplicity n−1n-1, and 00 is not a root of xn−1x^n-1. Hence gcd⁡(xn−1‾,nxn−1‾)=1\gcd(\overline{x^n-1}, \overline{nx^{n-1}}) = 1 in Fp[x]\mathbb{F}_p[x], i.e. xn−1x^n-1 is separable mod pp — contradicting the existence of the repeated factor pˉ\bar p. This contradiction proves the claim, completing Step 2.

Step 3: The Galois group. Q(ζn)\mathbb{Q}(\zeta_n) is the splitting field over Q\mathbb{Q} of xn−1x^n-1 (equivalently of Φn\Phi_n, since all primitive nn-th roots of unity are powers of ζn\zeta_n and lie in Q(ζn)\mathbb{Q}(\zeta_n), while all nn-th roots of unity are powers of primitive ones). A splitting field of a separable polynomial (separable since char Q=0\mathrm{char}\,\mathbb{Q}=0) over a field is always a Galois extension of that field — this is the standard equivalence in the Fundamental Theorem of Galois Theory characterizing Galois extensions as normal and separable splitting fields. Hence Q(ζn)/Q\mathbb{Q}(\zeta_n)/\mathbb{Q} is Galois, of degree φ(n)\varphi(n) by Step 2. Define Ψ:Gal(Q(ζn)/Q)→(Z/nZ)×\Psi: \mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) \to (\mathbb{Z}/n\mathbb{Z})^\times as follows. For σ\sigma in the Galois group, σ(ζn)\sigma(\zeta_n) is again a root of Φn\Phi_n (automorphisms permute roots of any polynomial fixed by the base field, in particular of the minimal polynomial of ζn\zeta_n), hence σ(ζn)=ζna\sigma(\zeta_n) = \zeta_n^{a} for a unique a∈{1,…,n}a \in \{1,\dots,n\} with gcd⁡(a,n)=1\gcd(a,n)=1 (since ζna\zeta_n^a must be a primitive root of unity, being a root of Φn\Phi_n). Set Ψ(σ)=a  n\Psi(\sigma) = a \bmod n. Ψ\Psi is well defined and injective: σ\sigma is determined by σ(ζn)\sigma(\zeta_n) because Q(ζn)=Q(ζn)\mathbb{Q}(\zeta_n) = \mathbb{Q}(\zeta_n) is generated over Q\mathbb{Q} by ζn\zeta_n alone, so a field automorphism fixing Q\mathbb{Q} is fully determined by where it sends the single generator ζn\zeta_n. Hence distinct σ\sigma's give distinct values a  na \bmod n, so Ψ\Psi is injective. Ψ\Psi is a homomorphism: for σ,τ\sigma, \tau in the Galois group with Ψ(σ)=a\Psi(\sigma) = a, Ψ(τ)=b\Psi(\tau) = b (so σ(ζn)=ζna\sigma(\zeta_n) = \zeta_n^a, τ(ζn)=ζnb\tau(\zeta_n) = \zeta_n^b),

(στ)(ζn)=σ(τ(ζn))=σ(ζnb)=σ(ζn)b=(ζna)b=ζnab,(\sigma\tau)(\zeta_n) = \sigma(\tau(\zeta_n)) = \sigma(\zeta_n^b) = \sigma(\zeta_n)^b = (\zeta_n^a)^b = \zeta_n^{ab},

using that σ\sigma is a ring homomorphism (so commutes with taking powers) and fixes rational — in particular integer — exponents structurally in the sense that σ(ζnb)=σ(ζn)b\sigma(\zeta_n^b)=\sigma(\zeta_n)^b. Hence Ψ(στ)=ab  n=Ψ(σ)Ψ(τ)\Psi(\sigma\tau) = ab \bmod n = \Psi(\sigma)\Psi(\tau) in (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times. Ψ\Psi is surjective: ∣Gal(Q(ζn)/Q)∣=[Q(ζn):Q]=φ(n)|\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q})| = [\mathbb{Q}(\zeta_n):\mathbb{Q}] = \varphi(n) (using that the extension is Galois, so the Galois group's order equals the degree — a basic consequence of the fundamental theorem's setup) and ∣(Z/nZ)×∣=φ(n)|(\mathbb{Z}/n\mathbb{Z})^\times| = \varphi(n) by definition of φ\varphi. An injective map between finite sets of equal size is automatically a bijection, so Ψ\Psi is surjective as well. Thus Ψ\Psi is a group isomorphism, proving Part 3 and finishing the theorem.

∎
CorollarySubfield correspondence

The subfields KK with Q⊆K⊆Q(ζn)\mathbb{Q} \subseteq K \subseteq \mathbb{Q}(\zeta_n) are in inclusion-reversing bijection with subgroups H≤(Z/nZ)×H \leq (\mathbb{Z}/n\mathbb{Z})^\times, via K↦{a∈(Z/nZ)×:σa fixes K pointwise}K \mapsto \{a \in (\mathbb{Z}/n\mathbb{Z})^\times : \sigma_a \text{ fixes } K \text{ pointwise}\}, where σa(ζn)=ζna\sigma_a(\zeta_n) = \zeta_n^a. This is immediate from the isomorphism of the theorem together with the Fundamental Theorem of Galois Theory applied to the Galois extension Q(ζn)/Q\mathbb{Q}(\zeta_n)/\mathbb{Q}.

Worked examples

Example 1: n=12n = 12. We compute Φ12(x)\Phi_{12}(x) directly from the divisor factorization and identify the Galois group and its subgroup/subfield lattice. The divisors of 1212 are 1,2,3,4,6,121,2,3,4,6,12. We know:

Φ1=x−1,Φ2=x+1,Φ3=x2+x+1,Φ4=x2+1,Φ6=x2−x+1.\Phi_1 = x-1,\quad \Phi_2 = x+1,\quad \Phi_3 = x^2+x+1,\quad \Phi_4 = x^2+1,\quad \Phi_6 = x^2-x+1.

(These come from x2−1=(x−1)(x+1)x^2-1=(x-1)(x+1), x3−1=(x−1)(x2+x+1)x^3-1=(x-1)(x^2+x+1), x4−1=(x−1)(x+1)(x2+1)x^4-1=(x-1)(x+1)(x^2+1), and x6−1=Φ1Φ2Φ3Φ6x^6-1=\Phi_1\Phi_2\Phi_3\Phi_6 giving Φ6=(x6−1)/((x−1)(x+1)(x2+x+1))=x2−x+1\Phi_6 = (x^6-1)/((x-1)(x+1)(x^2+x+1)) = x^2-x+1 by direct division.) From x12−1=Φ1Φ2Φ3Φ4Φ6Φ12x^{12}-1 = \Phi_1\Phi_2\Phi_3\Phi_4\Phi_6\Phi_{12}, divide:

Φ12(x)=x12−1(x−1)(x+1)(x2+x+1)(x2+1)(x2−x+1).\Phi_{12}(x) = \frac{x^{12}-1}{(x-1)(x+1)(x^2+x+1)(x^2+1)(x^2-x+1)}.

Compute the denominator step by step. First (x−1)(x+1)=x2−1(x-1)(x+1)=x^2-1. Next (x2−1)(x2+1)=x4−1(x^2-1)(x^2+1) = x^4-1. Then (x2+x+1)(x2−x+1)=x4+x2+1(x^2+x+1)(x^2-x+1) = x^4+x^2+1 (difference of squares pattern: (x2+1)2−x2=x4+x2+1(x^2+1)^2-x^2 = x^4+x^2+1). Multiply these two results:

(x4−1)(x4+x2+1)=x8+x6+x4−x4−x2−1=x8+x6−x2−1.(x^4-1)(x^4+x^2+1) = x^8+x^6+x^4 - x^4-x^2-1 = x^8+x^6-x^2-1.

Now divide x12−1x^{12}-1 by x8+x6−x2−1x^8+x^6-x^2-1. Trying Φ12(x)=x4−x2+1\Phi_{12}(x) = x^4-x^2+1 (a natural guess since deg⁡Φ12=φ(12)=4\deg \Phi_{12} = \varphi(12)=4):

(x4−x2+1)(x8+x6−x2−1)=x12+x10−x6−x4−x10−x8+x4+x2+x8+x6−x2−1.(x^4-x^2+1)(x^8+x^6-x^2-1) = x^{12}+x^{10}-x^6-x^4 - x^{10}-x^8+x^4+x^2 + x^8+x^6-x^2-1.

Collecting terms: x12+(x10−x10)+(−x8+x8)+(−x6+x6)+(−x4+x4)+(x2−x2)−1=x12−1x^{12} + (x^{10}-x^{10}) + (-x^8+x^8) + (-x^6+x^6) + (-x^4+x^4) + (x^2 - x^2) - 1 = x^{12}-1. This confirms

Φ12(x)=x4−x2+1,\Phi_{12}(x) = x^4 - x^2 + 1,

irreducible over Q\mathbb{Q} by the theorem, so [Q(ζ12):Q]=φ(12)=4[\mathbb{Q}(\zeta_{12}):\mathbb{Q}] = \varphi(12) = 4. Now (Z/12Z)×={1,5,7,11}(\mathbb{Z}/12\mathbb{Z})^\times = \{1,5,7,11\}, and one checks 52=25≡15^2 = 25 \equiv 1, 72=49≡17^2=49\equiv 1, 112=121≡1(mod12)11^2 = 121 \equiv 1 \pmod{12}, and 5⋅7=35≡115\cdot 7 = 35 \equiv 11, 5⋅11=55≡75 \cdot 11 = 55 \equiv 7, 7⋅11=77≡5(mod12)7\cdot 11 = 77 \equiv 5 \pmod{12}. Every non-identity element has order 22, so (Z/12Z)×≅Z/2Z×Z/2Z(\mathbb{Z}/12\mathbb{Z})^\times \cong \mathbb{Z}/2\mathbb{Z} \times \mathbb{Z}/2\mathbb{Z} (the Klein four-group). By the theorem, Gal(Q(ζ12)/Q)\mathrm{Gal}(\mathbb{Q}(\zeta_{12})/\mathbb{Q}) is also Klein four. By the Corollary, subfields of Q(ζ12)\mathbb{Q}(\zeta_{12}) correspond to the three proper nontrivial subgroups {1,5}\{1,5\}, {1,7}\{1,7\}, {1,11}\{1,11\}, each giving a subfield of degree 4/2=24/2=2 over Q\mathbb{Q}. Concretely: ζ12=eπi/6=cos⁡30∘+isin⁡30∘=32+i2\zeta_{12} = e^{\pi i/6} = \cos 30^\circ + i \sin 30^\circ = \tfrac{\sqrt3}{2}+\tfrac{i}{2}. One finds ζ12+ζ12−1=2cos⁡(30∘)=3\zeta_{12}+\zeta_{12}^{-1} = 2\cos(30^\circ) = \sqrt 3, and this is fixed exactly by the automorphism σ11\sigma_{11} (complex conjugation, ζ12↦ζ1211=ζˉ12\zeta_{12}\mapsto \zeta_{12}^{11}=\bar\zeta_{12}), giving the subfield Q(3)\mathbb{Q}(\sqrt3). Also ζ123=i\zeta_{12}^3 = i, giving Q(i)\mathbb{Q}(i) fixed by σ7\sigma_7 (since σ7(ζ123)=ζ1221=ζ129=ζ12−3=−i\sigma_7(\zeta_{12}^3) = \zeta_{12}^{21}=\zeta_{12}^{9}=\zeta_{12}^{-3}=-i... one must instead check σ7(i)=σ7(ζ123)=ζ1221=ζ1221−12=ζ129=−i⋅\sigma_7(i)=\sigma_7(\zeta_{12}^3)=\zeta_{12}^{21}=\zeta_{12}^{21-12}=\zeta_{12}^9 = -i \cdot recompute: ζ129=ζ12−3=ζ123‾=i‾=−i\zeta_{12}^9 = \zeta_{12}^{-3}=\overline{\zeta_{12}^3}=\overline i=-i, so actually σ7\sigma_7 moves ii; the correct fixed field of {1,7}\{1,7\} is instead identified by testing σ5(i)=ζ1215=ζ123=i\sigma_5(i) = \zeta_{12}^{15}=\zeta_{12}^3=i, so {1,5}\{1,5\} fixes Q(i)\mathbb{Q}(i), and {1,11}\{1,11\} fixes Q(3)\mathbb{Q}(\sqrt3), leaving {1,7}\{1,7\} to fix the third quadratic subfield Q(−3)\mathbb{Q}(\sqrt{-3}) (since ζ122=ζ6\zeta_{12}^2 = \zeta_6 satisfies ζ6+ζ6−1=1\zeta_6+\zeta_6^{-1}=1 and ζ6−ζ6−1=i3\zeta_6 - \zeta_6^{-1} = i\sqrt3, giving −3=ζ6−ζ6−1∈Q(ζ12)\sqrt{-3} = \zeta_6-\zeta_6^{-1} \in \mathbb{Q}(\zeta_{12}), fixed by σ7\sigma_7 since σ7(ζ6)=ζ1214=ζ122=ζ6\sigma_7(\zeta_6)=\zeta_{12}^{14}=\zeta_{12}^2=\zeta_6 because 7⋅2=14≡2(mod12)7\cdot 2=14\equiv 2 \pmod{12}). So the three quadratic subfields are Q(i),Q(3),Q(−3)\mathbb{Q}(i), \mathbb{Q}(\sqrt3),\mathbb{Q}(\sqrt{-3}), matching [Q(ζ12):Q]=4[\mathbb{Q}(\zeta_{12}):\mathbb{Q}]=4 and the expected Klein-four lattice of intermediate fields.

Example 2: n=20n=20. Here φ(20)=φ(4)φ(5)=2⋅4=8\varphi(20) = \varphi(4)\varphi(5) = 2\cdot 4 = 8, so [Q(ζ20):Q]=8[\mathbb{Q}(\zeta_{20}):\mathbb{Q}]=8 and ∣(Z/20Z)×∣=8|(\mathbb{Z}/20\mathbb{Z})^\times| = 8. We determine the group structure of (Z/20Z)×(\mathbb{Z}/20\mathbb{Z})^\times. By the Chinese Remainder Theorem, (Z/20Z)×≅(Z/4Z)××(Z/5Z)×≅Z/2Z×Z/4Z(\mathbb{Z}/20\mathbb{Z})^\times \cong (\mathbb{Z}/4\mathbb{Z})^\times \times (\mathbb{Z}/5\mathbb{Z})^\times \cong \mathbb{Z}/2\mathbb{Z} \times \mathbb{Z}/4\mathbb{Z} (since (Z/4Z)×={1,3}≅Z/2(\mathbb{Z}/4\mathbb{Z})^\times=\{1,3\}\cong \mathbb{Z}/2, and (Z/5Z)×={1,2,3,4}(\mathbb{Z}/5\mathbb{Z})^\times = \{1,2,3,4\} is cyclic of order 4, generated by 22: 21=2,22=4,23=3,24=12^1=2,2^2=4,2^3=3,2^4=1). This group is abelian of order 88, isomorphic to Z/2×Z/4\mathbb{Z}/2\times\mathbb{Z}/4 — not cyclic, since e.g. 9≡−11(mod20)9 \equiv -11 \pmod{20} has 92=81≡19^2=81\equiv 1, so not every element has order 88; explicitly checking orders: 31=3,32=9,33=27≡7,34=21≡13^1=3,3^2=9,3^3=27\equiv7,3^4=21\equiv1, so 33 has order 44; and 112=121≡1(mod20)11^2 = 121\equiv 1\pmod{20}, so 1111 has order 22; and ⟨3⟩∩⟨11⟩\langle 3\rangle \cap \langle 11\rangle: is 11∈⟨3⟩={1,3,9,7}11 \in \langle 3\rangle = \{1,3,9,7\}? No. So (Z/20Z)×=⟨3⟩×⟨11⟩≅Z/4×Z/2(\mathbb{Z}/20\mathbb{Z})^\times = \langle 3\rangle \times \langle 11 \rangle \cong \mathbb{Z}/4\times \mathbb{Z}/2, confirmed. By the Corollary, Gal(Q(ζ20)/Q)≅Z/4×Z/2\mathrm{Gal}(\mathbb{Q}(\zeta_{20})/\mathbb{Q}) \cong \mathbb{Z}/4\times\mathbb{Z}/2 has subgroups of orders 1,2,2,2,4,4,81,2,2,2,4,4,8 (and possibly more of order 22 or 44 — precisely, this group has three subgroups of order 22 generated respectively by the unique order-2 element of the Z/4\mathbb{Z}/4 factor, the generator of Z/2\mathbb{Z}/2, and their product, plus subgroups of order 4). Each subgroup HH corresponds to a subfield of degree 8/∣H∣8/|H| fixed by HH. For instance the subgroup of order 44 generated by 33 alone (i.e. {1,3,9,7}(mod20)\{1,3,9,7\} \pmod{20}) corresponds to a subfield of degree 8/4=28/4=2 over Q\mathbb{Q}; since 9=32≡−11(mod20)9 = 3^2 \equiv -11 \pmod{20} and one can show this subgroup fixes Q(5)\mathbb{Q}(\sqrt5) (because 55 ramifies specially in Q(ζ20)\mathbb{Q}(\zeta_{20}), and the unique quadratic subfield unramified outside {2,5}\{2,5\} compatible with the fixed subgroup structure is Q(5)\mathbb{Q}(\sqrt5) — this can be checked directly via Gauss sums, though that machinery is beyond our present scope). This illustrates how quickly the subgroup lattice of (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times becomes the full combinatorial content of the subfield lattice of Q(ζn)\mathbb{Q}(\zeta_n).

CounterexampleWhy we need characteristic not dividing nn

The theorem's proof of irreducibility (and even the basic setup of μn\mu_n having nn distinct elements) used crucially that char(F)∤n\mathrm{char}(F) \nmid n, ensuring xn−1x^n-1 is separable. Here is what fails when this hypothesis is dropped. Work over F=F2F = \mathbb{F}_2 and take n=2n = 2. Then x2−1=(x−1)2x^2 - 1 = (x-1)^2 in F2[x]\mathbb{F}_2[x] — a repeated root, not 22 distinct roots. The set of "square roots of unity" in F2‾\overline{\mathbb{F}_2} is just {1}\{1\}, a single element, not a cyclic group of order 22. There is no primitive 22nd root of unity in characteristic 22 at all: the notion of "Φ2(x)\Phi_2(x), the minimal polynomial of a primitive square root of unity" is vacuous, since no element of any extension of F2\mathbb{F}_2 has multiplicative order exactly 22 (the multiplicative group of any finite field of characteristic 22 has odd order, being 2k−12^k - 1, so it contains no element of even order 22 at all). This directly contradicts what would be the naive extension of the theorem's Part 1: x2−1=Φ1(x)Φ2(x)x^2-1=\Phi_1(x)\Phi_2(x) cannot hold as a product of two distinct monic linear factors, because x2−1x^2-1 is not separable. More generally, for FF of characteristic pp and n=pamn = p^a m with gcd⁡(p,m)=1\gcd(p,m)=1, one has xn−1=(xm−1)pax^n - 1 = (x^m-1)^{p^a} in F[x]F[x] (by repeated Frobenius: (xm−1)p=xmp−1(x^m - 1)^p = x^{mp}-1 in characteristic pp, since all "cross terms" in the binomial expansion have coefficients divisible by pp), so xn−1x^n-1 has only the φ(m)\varphi(m)-many actual distinct primitive-type behaviors of xm−1x^m - 1, each repeated pap^a times — the clean bijection between divisors of nn and cyclotomic factors, and the very meaning of "primitive nn-th root of unity" as an element of order exactly nn, breaks down whenever p∣np \mid n. This is exactly why the hypothesis char(F)∤n\mathrm{char}(F) \nmid n (in our case char(Q)=0\mathrm{char}(\mathbb{Q})=0, automatically coprime to every nn) is non-negotiable in the definition and in every step of the theorem's proof, including the key separability argument used to rule out repeated irreducible factors mod pp in Step 2.

Scope, edge cases & common traps

SituationWhat happensWhy
n=1,2n=1,2Φ1=x−1, Φ2=x+1\Phi_1=x-1,\ \Phi_2=x+1, Q(ζn)=Q\mathbb{Q}(\zeta_n)=\mathbb{Q}φ(1)=φ(2)=1\varphi(1)=\varphi(2)=1
n=pn=p primeΦp(x)=1+x+⋯+xp−1\Phi_p(x)=1+x+\cdots+x^{p-1}, Eisenstein-irreducible at pp after shifting x↦x+1x\mapsto x+1classic special case of the general irreducibility theorem
nn vs. 2n2n for nn oddQ(ζn)=Q(ζ2n)\mathbb{Q}(\zeta_n)=\mathbb{Q}(\zeta_{2n})−ζn-\zeta_n is a primitive 2n2n-th root when nn is odd, and generates the same field
char(F)∣n\mathrm{char}(F)\mid ntheory collapses, no primitive root of that order existssee counterexample above
computing Gal\mathrm{Gal} for composite nnuse CRT: (Z/nZ)×≅∏(Z/piaiZ)×(\mathbb{Z}/n\mathbb{Z})^\times\cong\prod (\mathbb{Z}/p_i^{a_i}\mathbb{Z})^\timesmultiplicativity of units group under coprime factorization

The mathematician behind it

Origins · 1 minCarl Friedrich Gauss and how this was discovered
CF
Carl Friedrich Gauss
1777–1855 · Germany, Duchy of Brunswick and Kingdom of Hanover

Gauss essentially invented the theory of cyclotomic fields — decades before the language of "fields" or "Galois groups" existed — in his 1801 Disquisitiones Arithmeticae. There he analyzed the equation xp=1x^p=1 for prime pp by studying "periods" of roots of unity built from the cyclic structure of (Z/pZ)×(\mathbb{Z}/p\mathbb{Z})^\times, and used this analysis to give the first proof that the regular 1717-gon is constructible by straightedge and compass — the first genuinely new constructibility result since antiquity. His method amounts to recursively finding the intermediate fixed fields corresponding to the subgroup chain inside (Z/17Z)×(\mathbb{Z}/17\mathbb{Z})^\times, a cyclic group of order 16=2416 = 2^4, though he had none of the modern Galois-theoretic vocabulary to describe it that way.

History
- 1796: Gauss, age 19, proves the regular 17-gon is constructible.
- 1801: Disquisitiones Arithmeticae published, containing the theory of cyclotomy and periods of roots of unity.
- 1830s: Galois develops general group-theoretic language, later used to reinterpret Gauss's cyclotomic periods as subgroups of (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times.
- 1847: Kummer studies cyclotomic fields Q(ζp)\mathbb{Q}(\zeta_p) intensively while working on Fermat's Last Theorem, introducing ideal numbers.
- 1853/1886: Kronecker and Weber state and eventually fully prove that every abelian extension of Q\mathbb{Q} lies inside a cyclotomic field.
Is Q(ζn)\mathbb{Q}(\zeta_n) always a strictly bigger field than Q\mathbb{Q}?

Yes for n≥3n \geq 3, but not for n=1,2n=1,2. Since [Q(ζn):Q]=φ(n)[\mathbb{Q}(\zeta_n):\mathbb{Q}] = \varphi(n), the extension is trivial exactly when φ(n)=1\varphi(n)=1, which happens only for n=1n=1 (where ζ1=1\zeta_1=1) and n=2n=2 (where ζ2=−1\zeta_2=-1, already rational). For every n≥3n\geq 3, φ(n)≥2\varphi(n)\geq 2, so Q(ζn)\mathbb{Q}(\zeta_n) is a genuine proper extension, and in fact ζn\zeta_n is never real for n≥3n \geq 3 except when it equals ±1\pm1, which doesn't happen for a primitive root of order ≥3\geq 3.

Why is Gal(Q(ζn)/Q)\mathrm{Gal}(\mathbb{Q}(\zeta_n)/\mathbb{Q}) always abelian, when general Galois groups need not be?

The Galois group embeds into (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times, the units of a commutative ring, which is abelian under multiplication by ring axioms alone. The proof shows this embedding is in fact an isomorphism, transferring commutativity for free. Intuitively, an automorphism is fully pinned down by a single exponent aa with ζn↦ζna\zeta_n\mapsto\zeta_n^a, and composing two such maps just multiplies exponents — multiplication of integers is commutative, so composition of automorphisms is commutative too. This is special to cyclotomic (and more generally cyclic-kernel) situations; it does not generalize to splitting fields of arbitrary polynomials.

Does Φn(x)\Phi_n(x) always have coefficients in {−1,0,1}\{-1,0,1\}?

No, this is a common misconception based on small examples. It is true for nn with at most two distinct odd prime factors (and more precisely for nn a prime power, or twice a prime power, or a product of two prime powers under certain conditions), but fails in general. The smallest counterexample is n=105=3⋅5⋅7n=105 = 3\cdot5\cdot7, where Φ105(x)\Phi_{105}(x) has a coefficient equal to −2-2. This shows the visually appealing pattern from small cases is not a theorem.

How does one actually compute Φn(x)\Phi_n(x) in practice?

The most direct method uses the divisor factorization: compute Φd(x)\Phi_d(x) for all proper divisors dd of nn recursively (starting from Φ1=x−1\Phi_1=x-1), multiply them together, and divide xn−1x^n-1 by that product using polynomial long division. Because the divisor product is monic with integer coefficients, the division stays in Z[x]\mathbb{Z}[x] throughout, exactly as illustrated in the n=12n=12 worked example. For prime n=pn=p, there is a shortcut: Φp(x)=(xp−1)/(x−1)=1+x+⋯+xp−1\Phi_p(x) = (x^p-1)/(x-1) = 1+x+\cdots+x^{p-1} directly.

What is the relationship between constructible regular nn-gons and this theory?

A regular nn-gon is constructible by straightedge and compass exactly when Q(ζn)\mathbb{Q}(\zeta_n) can be reached from Q\mathbb{Q} by a tower of quadratic extensions, which by the Galois correspondence happens exactly when φ(n)\varphi(n) is a power of 22. Gauss showed this translates to n=2kp1p2⋯prn = 2^k p_1 p_2 \cdots p_r with the pip_i distinct Fermat primes (3,5,17,257,655373,5,17,257,65537 are the only ones currently known). This constructibility criterion is developed fully under Constructible Numbers, building directly on the cyclotomic Galois group computed here.

Why does irreducibility of Φn\Phi_n fail to follow trivially from Eisenstein's criterion for composite nn?

Eisenstein's criterion applies directly only to Φp(x+1)\Phi_p(x+1) for prime pp (after a shift), where the binomial coefficients (pk)\binom{p}{k} for 0<k<p0<k<p are all divisible by pp. For composite nn, no such clean shift-and-apply-Eisenstein trick works uniformly, since Φn(x)\Phi_n(x)'s coefficients don't satisfy an Eisenstein-type pattern at any single prime in general. This is exactly why the theorem's proof instead uses the mod-pp Frobenius argument, a fundamentally different and more robust technique that works for every nn simultaneously.

Is every subfield of Q(ζn)\mathbb{Q}(\zeta_n) itself abelian over Q\mathbb{Q}?

Yes. If KK is any subfield with Q⊆K⊆Q(ζn)\mathbb{Q}\subseteq K\subseteq\mathbb{Q}(\zeta_n), then KK corresponds to a subgroup H≤(Z/nZ)×H\leq(\mathbb{Z}/n\mathbb{Z})^\times, and since (Z/nZ)×(\mathbb{Z}/n\mathbb{Z})^\times is abelian, HH is automatically a normal subgroup. By the fundamental theorem of Galois theory, K/QK/\mathbb{Q} is then itself Galois, with Gal(K/Q)≅(Z/nZ)×/H\mathrm{Gal}(K/\mathbb{Q})\cong(\mathbb{Z}/n\mathbb{Z})^\times/H, a quotient of an abelian group, hence abelian. This is a key reason cyclotomic fields are the natural home for studying abelian extensions of Q\mathbb{Q}.

Before this

Where this leads