The Primitive Element Theorem

The Primitive Element Theorem is the quiet workhorse behind computational algebraic number theory: number fields are almost universally represented in computer algebra systems as $\mathbb{Q}(\theta) = \mathbb{Q}[x]/(m_\theta(x))$ for a single primitive element $\theta$, even when the field arises naturally with several generators (e.g., as a compositum or splitting field), because arithmetic in a single-generator representation is vastly simpler to implement. In Galois theory itself, the theorem is the technical hinge that lets you replace "the field generated by several roots of a polynomial" with a single algebraic number, so that automorphisms of the splitting field correspond exactly to the distinct roots of a single minimal polynomial — this counting argument is precisely what powers the proof of the Fundamental Theorem of Galois Theory and the equality $|\mathrm{Gal}(K/F)| = [K:F]$ for Galois extensions. In cryptography, finite fields $\mathbb{F}_{p^n}$ used in elliptic curve cryptography and in classical Diffie–Hellman-type schemes over $\mathbb{F}_{p^n}^\times$ are represented via a primitive element (often literally a primitive root generating the multiplicative group), which is the finite-field case of this very theorem, tying discrete-log-based cryptosystems directly to the cyclicity argument used above. In the study of algebraic geometry and function fields, the failure of the theorem in the inseparable case (as in the counterexample) is not a curiosity but a genuine phenomenon studied under the heading of purely inseparable extensions and $p$-bases, relevant to characteristic-$p$ algebraic geometry and the theory of Frobenius twists.

Ask the tutor: How does the Primitive Element Theorem get used to prove that Galois extensions have exactly $[K:F]$ automorphisms?

Picture $K = F(\alpha_1, \dots, \alpha_n)$ as a tower built by adjoining generators one at a time. Each step $F(\alpha_1,\dots,\alpha_i) \subsetneq F(\alpha_1,\dots,\alpha_{i+1})$ potentially needs its own generator, so naively the field seems to need $n$ "coordinates." The Primitive Element Theorem says this apparent multi-dimensionality is an illusion when the extension is separable: a single $F$-linear combination

for a suitably chosen scalar $c \in F$ already generates $F(\alpha_1, \alpha_2)$. The mechanism is a clash-avoidance argument: there are only finitely many "bad" values of $c$ that fail to separate the roots of the relevant minimal polynomials, and if $F$ is infinite there's always a good value left over. Think of the minimal polynomial $m_{\alpha_1}(x)$ over $F$ and its roots $\alpha_1 = \alpha_1^{(1)}, \dots, \alpha_1^{(r)}$ in a splitting field, and similarly for $\alpha_2$. The condition that $c$ is "bad" amounts to a certain finite set of linear equations in $c$ having a solution — each equation rules out at most one value of $c$. Since $F$ is infinite, infinitely many values remain untouched, and any one of them makes $\gamma = \alpha_1 + c\alpha_2$ primitive.

Example 1 (finding an explicit primitive element and verifying it). Let $F = \mathbb{Q}$ and $K = \mathbb{Q}(\sqrt[3]{2}, \omega)$ where $\omega = e^{2\pi i/3}$ is a primitive cube root of unity, the splitting field of $x^3 - 2$. We have $[\mathbb{Q}(\sqrt[3]{2}):\mathbb{Q}] = 3$ and $[\mathbb{Q}(\omega):\mathbb{Q}] = 2$, and since these degrees are coprime and $K = \mathbb{Q}(\sqrt[3]{2},\omega)$, one computes $[K:\mathbb{Q}] = 6$. Since $\operatorname{char}\mathbb{Q} = 0$, every algebraic extension of $\mathbb{Q}$ is separable, so the theorem applies. Set $\alpha = \sqrt[3]{2}$, $\beta = \omega$, and try $\gamma = \alpha + \beta = \sqrt[3]{2} + \omega$ (taking $c = 1$, since $\mathbb{Q}$ is infinite the theorem guarantees almost every $c$ works, and we verify $c=1$ directly rather than trusting a random guess). We must check $\mathbb{Q}(\gamma) = K$. Since $\gamma \in K$, certainly $\mathbb{Q}(\gamma) \subseteq K$, so $[\mathbb{Q}(\gamma):\mathbb{Q}]$ divides $6$ and we must show it equals $6$, i.e. that $\gamma$ has degree $6$ over $\mathbb{Q}$ (equivalently $\mathbb{Q}(\gamma) = K$, since a proper subfield would have degree $1, 2,$ or $3$). Suppose for contradiction $\mathbb{Q}(\gamma) \ne K$. The subfields of $K$ strictly between $\mathbb{Q}$ and $K$ have degree $2$ or $3$ over $\mathbb{Q}$ (as $K/\mathbb{Q}$ is Galois of degree $6$ with Galois group $S_3$, whose subgroups have index $1,2,3,6$; we may verify this independently of full Galois theory as follows). The only subfield of degree $2$ is $\mathbb{Q}(\omega)$ (it's the unique quadratic subfield, since a degree 2 subfield corresponds to an index-3 subgroup, and $S_3$ has a unique subgroup of index $3$, namely $A_3$). The subfields of degree $3$ are $\mathbb{Q}(\sqrt[3]{2}), \mathbb{Q}(\omega\sqrt[3]{2}), \mathbb{Q}(\omega^2\sqrt[3]{2})$, the three real-embeddable images under the three cube roots of $2$. If $\gamma \in \mathbb{Q}(\omega)$, then since $\mathbb{Q}(\omega) \subset \mathbb{R}(i)$-type field is $\mathbb{Q}(\sqrt{-3})$, while $\gamma = \sqrt[3]{2}+\omega$ has real part $\sqrt[3]{2} - \frac12 \ne$ a rational combination fitting $\mathbb{Q}(\sqrt{-3})$'s real elements are just $\mathbb{Q}$; concretely $\mathbb{Q}(\omega) = \{a + b\omega : a,b \in \mathbb{Q}\}$ has all elements of the form with rational "coordinates" in basis $1,\omega$, but $\gamma = \sqrt[3]{2} \cdot 1 + 1\cdot \omega$ would require $\sqrt[3]{2} \in \mathbb{Q}$, false. So $\gamma \notin \mathbb{Q}(\omega)$. If $\gamma$ lay in a degree-3 subfield $L$, then since $[K:L]=2$, complex conjugation restricted to $K$ (which fixes $\mathbb{Q}(\sqrt[3]{2})$ pointwise, as that field is real, and sends $\omega \mapsto \bar\omega = \omega^2$) is the nontrivial automorphism fixing $L$ when $L = \mathbb{Q}(\sqrt[3]2)$. Applying it to $\gamma = \sqrt[3]{2}+\omega$ gives $\sqrt[3]{2} + \omega^2 \ne \gamma$ (since $\omega \ne \omega^2$), so $\gamma \notin \mathbb{Q}(\sqrt[3]{2})$ (elements of $\mathbb{Q}(\sqrt[3]2)$ are fixed by conjugation as that field is real). A symmetric check (using the automorphisms permuting the three cube roots) rules out the other two cubic subfields similarly, since $\gamma$ is not fixed by any of the order-2 or order-3 subgroups other than the trivial one. Hence $\gamma$ lies in no proper subfield, so $\mathbb{Q}(\gamma) = K$, confirming $\gamma = \sqrt[3]{2} + \omega$ is a primitive element, with minimal polynomial of degree $6$ over $\mathbb{Q}$.

Example 2 (a genuinely finite-field computation). Let $F = \mathbb{F}_3$ and $K = \mathbb{F}_{27} = \mathbb{F}_{3^3}$, the (unique up to isomorphism) field with $27$ elements, viewed as a degree-$3$ extension of $\mathbb{F}_3$. Every extension of a finite field is separable (finite fields are perfect), so the theorem guarantees $K = \mathbb{F}_3(\alpha)$ for some $\alpha$, and moreover the proof shows we can take $\alpha$ to be any generator of the cyclic group $K^\times$, which has order $26$. Concretely, realize $K = \mathbb{F}_3[x]/(x^3 - x + 1)$: one checks $x^3 - x + 1$ is irreducible over $\mathbb{F}_3$ by testing all three elements $0,1,2$ as roots ($0^3-0+1=1$, $1^3-1+1=1$, $2^3-2+1 = 8-2+1=7\equiv1 \pmod 3$, none are zero, and a cubic with no root in $\mathbb{F}_3$ is irreducible over $\mathbb{F}_3$ since a factorization would need a linear factor). Let $\alpha$ be the image of $x$, so $\alpha^3 = \alpha - 1$ in $K$. We claim $\alpha$ generates $K^\times$, a group of order $26 = 2 \cdot 13$. To have order dividing $26$ but not equal to $26$, $\alpha$ would need order $1, 2,$ or $13$. Order $1$ is impossible since $\alpha \ne 1$. Order $2$ would force $\alpha^2 = 1$, i.e. $\alpha$ satisfies $x^2-1$, a polynomial of degree $2 < 3 = [\mathbb{F}_3(\alpha):\mathbb{F}_3]$, impossible since $\alpha$'s minimal polynomial has degree exactly $3$ (as $x^3-x+1$ is irreducible). For order $13$: we would need $\alpha^{13} = 1$. Compute successive powers using $\alpha^3 = \alpha - 1$:

Multiply directly:

Substitute $\alpha^4 = \alpha^2 - \alpha$:

So $\alpha^{13} = 2 = -1 \ne 1$ in $K$. Since $\alpha^{13} \ne 1$, the order of $\alpha$ does not divide $13$, and we've excluded orders $1,2,13$, so by Lagrange's theorem the order of $\alpha$ must be $26$. Hence $\alpha$ generates $K^\times$, and

This matches the theorem's finite-field case exactly: the primitive element is produced as a generator of the cyclic group $K^\times$, and indeed $\alpha^{13} = -1$ confirms $\alpha$ is a primitive $26$th root of unity in $K^\times$.