# Collecting proofs that finite multiplicative subgroups of fields are cyclic

I teach elementary number theory and discrete mathematics to students who come with no abstract algebra. I have found proving the key theorem that finite multiplicative subgroups of fields are cyclic a pedagogical speedbump. For example, Serre's proof in A Course in Arithmetic runs a full page, requires introducing Euler's $$\phi$$-function, and depends on a counting argument that might seem to beginners too clever or magical for a cornerstone result.

I'd like to have a collection of proofs of this fact, to compare their advantages, to match their viewpoints to my various audiences, to contrast for my students, etc.

To get the ball rolling, here's the shortest argument I can think of (and if it's in the literature somewhere I'd love a reference).

Induction on the order of the subgroup. So suppose multiplicative subgroup $$G$$ of field $$F$$ has order $$n$$. If $$n=p^k$$ with $$p$$ prime and $$G$$ isn't cyclic, all $$p^k$$ elements of $$G$$ satisfy $$x^{p^{k-1}}-1=0$$, impossible.
If $$n=ab$$, $$\gcd(a,b)=1$$, then $$(\cdot)^a:G\rightarrow G$$ has a kernel $$A$$ of size at most $$a$$ and a range $$B$$ of size at most $$b$$ (since the $$y\in B$$ satisfy $$y^b=1$$), so $$|A|=a$$, $$|B|=b$$, and a product $$xy$$ of cyclic generators $$x,y$$ for $$A,B$$ respectively generates $$G$$.

If you know published proofs distinctly different from either of these, please cite a source. No need to spell out the details, but please mention a key feature to help avoid duplicates. If you have your own favorite approach, please share it.

• It looks like your short argument uses a nontrivial assertion about the exponent of a non-cyclic abelian $p$-group, and another assertion about the number of roots of a polynomial over a field. In particular, I don't see why this argument is substantially simpler than the corresponding fact for the case of $n$ with more than one prime divisor (which would allow you to eliminate the last sentence). Feb 8, 2011 at 8:59
• By the way, having just looked at my copy of Serre's book, I can say that "Serre's proof...runs a full page" is an exaggeration: it is about 2/3 of a page, with generous spacing. If we are talking pedagogy, then I recommend against optimizing the argument for length: better to have a medium length argument with all the details spelled out than a relatively cryptic short argument. Feb 8, 2011 at 10:00
• One more comment: don't you want to introduce Euler's $\varphi$ function in a number theory course? As a number theorist, I would defend introducing it even in a pure algebra course, but in a number theory course it seems almost mandatory. Feb 8, 2011 at 10:02
• @Pete I will teach Euler's $\phi$ and circle back to this theorem. But here's my pedagogical axe (and MO might not be the right place for this discussion...but where?) My students lack mathematical maturity and thus don't relish proofs that depend on extrinsic ideas. I aim to get them used to all that, but using examples where extrinsic ideas are essential. But with this proof, I think $\phi$ enters as a mere bookkeeping device. The mysterious stranger will seem like the protagonist in a short mysterious tale, which misleads beginners. Feb 8, 2011 at 23:38
• @Pete, cont. My pedagogical principle with students who lack mathematical maturity aims at postponing the "I never could have thought of that in a million years moments," in order to foster a sense that proofs of cornerstone theorems really would emerge given sufficient time and thought. Feb 8, 2011 at 23:38

Let $n = |G|$ and let $m$ be the l.c.m. of the orders of the cyclic factors of $G$. Then $x^m = 1$ for all $x \in G$; since we are in a field this equation has at most $m$ roots, which shows that $m \geq n$. It follows that $m = n$ and $G$ is cyclic.

Of course here one uses the classification of finite abelian groups as product of cyclic groups, which you may want to avoid.

• @Andrea: in my opinion, you are using a much harder result to prove a much easier result. It doesn't make much sense. If you read Serre's book carefully, he makes a point of never using the structure theorem for finite abelian groups (and he makes it all the way to Dirichlet's theorem in this way). I have some remarks on this in Section 4.4 of the notes linked to in my answer. (And then in Section 5 I prove the structure theorem, so you can see how much harder it is!) Feb 8, 2011 at 10:05
• I think you can get away with using a weaker result that is independently useful: namely, let n be the lcm of the orders of all elements of G and then prove that if an abelian group has elements of orders n and m then it has an element of order lcm(n, m). I don't remember how hard this is to prove from first principles, though. Feb 8, 2011 at 11:23
• @Qiaochu Yuan: It's relatively easy. First prove that $ord(xy)=ord(x)ord(y)$ if $gcd(ord(x),ord(y))=1$. Then prove that for every divisor of $ord(x)$ there is a power of $x$ with exactly that order. Then use the characterization of the lcm in terms of prime decomposition to show that there are exponents $k,m$ such that $ord(x^k y^m)=lcm(ord(x),ord(y))$. Feb 8, 2011 at 11:31
• @Pete: Yes, I'm aware that classification of finite abelian groups may be a cannonball here. On the other hand, in the introductory algebra course in Italy one usually encounters groups before more complicated structures like fields (at least, it used to be like that) so one may have the result at hand anyway. In any case the question was about collecting proofs of this results, so I thought it may be worth to add this one. :-) Feb 8, 2011 at 12:41
• @Johannes: nice. I think that entire argument is simpler than any of the proofs that have been presented so far, but maybe I am missing some subtlety. Feb 8, 2011 at 17:51

I once collected six [edit: now seven [edit: now eight [edit:now nine [edit: now ten]]]] proofs of this theorem, for the field $$\mathbf Z/(p)$$, and they can be found here. While $$\mathbf Z/(p)$$ is not a general finite field, since the intent of this MO question is to use proofs in a course for undergraduates without much background I think surely $$\mathbf Z/(p)$$ is the only finite field that matters for that pedagogical purpose.

• Well, this certainly seems like the best possible answer to this question! Feb 8, 2011 at 17:31
• Pete--Surprisingly, the proof that the proposer and I give doesn't appear to be one of Keith's six. Feb 8, 2011 at 17:44
• Paul: it's not that surprising (to me) since I basically brought together the proofs I was able to find in books. Now I'll have to include the proof you describe, someday... Feb 9, 2011 at 1:30
• @paulMonsky the "someday" finally arrived and I included in that file the argument you and the OP give. See the fourth proof. Nov 18, 2017 at 4:27
• $\mathbb Z/p\mathbb Z$ is not the only finite field, but, even if it were, $(\mathbb Z/p\mathbb Z)^\times$ would not be the only finite subgroup of the multiplicative group of a field. At least for me, I found it much more surprising when I first learned it that this holds for arbitrary finite subgroups of multiplicative groups of fields, even if the fields themselves are infinite. Feb 13 at 22:52

Let $G$ be a finite subgroup of $F^{\ast}$ of order $n$. Then all the elements of $G$ satisfy $x^n = 1$ in $F$. Since polynomials of degree $n$ over a field have at most $n$ roots, it follows that the roots of $x^n = 1$ in $F$ are precisely the elements of $G$.

The intuitive content of Serre's argument is as follows: if no element of $G$ has order $n$, then they all have to have order less than $n$, so they satisfy various smaller polynomials $x^d = 1$ for $d | n$, and what the counting argument is trying to show is that there isn't enough "room" in these polynomials for all of these roots. I think this is quite intuitive, and it is completely clear for $n$ a prime power, but you want to avoid it, so:

Over $\mathbb{C}$, the roots of $x^n = 1$ are precisely the $n^{th}$ roots of unity. It is natural to organize these by their order, so let $\Phi_d(x) = \prod_{\zeta \text{ has order exactly } d} (x - \zeta)$. The result that Serre is trying to avoid with his counting argument is that $\Phi_d(x)$ has integer coefficients, so the factorization

$$x^n - 1 = \prod_{d | n} \Phi_d(x)$$

makes sense over an arbitrary field. If you can show this, the rest of the proof is trivial: since $x^n = 1$ splits over $F$, it follows that $\Phi_n(g) = 0$ for some $g \in G$, and such an element must have order $n$ and therefore be a generator.

If your students really have no algebra background I think you should consider stating this without proof. It is easy to give examples and hopefully you can give enough to convince them.

The shortest way I can think of to prove that $\Phi_n(x)$ has integer coefficients is by induction and the identity $\gcd(x^n - 1, x^m - 1) = x^{\gcd(n,m)} - 1$, which again 1) is intuitive over $\mathbb{C}$ but 2) makes sense over an arbitrary field. But this is a bit of a detour and precisely why Serre did something trickier. However, I think the larger lesson that "algebraic things that are intuitive over $\mathbb{C}$ are worth generalizing" is worth learning.

• Initially, I didn't see why it was necessary to mention the complex numbers, since the statement about the $n^{th}$ roots of unity seemed a little tautological. Now I think you may be suggesting that in the complex case there is both a geometric way to visualize the fact that finite torsion subgroups of $\mathbb{C}^\times$ are cyclic, and an explicit formula for elements of order exactly $n$. Feb 8, 2011 at 10:31
• We need to find ONE field extension of $\mathbb Q$ which contains a primitive $n$-th root of unity. How do you do this without complex numbers? This is exactly the reason why I dislike Quiaochu's proof: it's geometric. Feb 8, 2011 at 10:45
• @Scott: more or less. That comment about complex numbers is entirely by way of motivation, e.g. "let's motivate this factorization and then prove it exists over Z." I think it is okay to emphasize motivation over rigor in a first course like the one described, and students should be made thoroughly aware of the complex case if they aren't anyway. Feb 8, 2011 at 10:56
• Without $\mathbb C$, how do you know that $\Phi_n\neq 1$? Feb 8, 2011 at 17:37
• @darij: $\Phi_n$ is uniquely defined by Mobius inversion, if you prefer. Feb 8, 2011 at 17:49

Let $n$ be the number of elements of $F^*$, $p$ be a prime dividing $n$, $q$ be the largest power of $p$ dividing $n$; let $r=q/p$. Look at the map $x \mapsto x^{(n/q)}$, $F^*\to F^*$. The kernel has order at most $n/q$, so the image has order at least $q$, and there are at least $q$ solutions of $x^q=1$. Since there are at most $r$ solutions of $x^r=1$, there is an element of exact order $q$; multiplying these elements together for the various $p$ dividing $n$ gives a generator.

(I've used this no doubt well-known argument successfully in undergrad courses).

Edit: For the final step, let $u$ be the product. Then $u^{(n/p)}=a^{(n/p)}$ where $a$ has exact order $q$. So $u^{(n/p)}$ is not $1$ for all $p$, and $u$ has exact order $n$, and is a generator. Looking again at the question, I realize that this is essentially the same as the proposer's short solution, though I've restricted my attention unnecessarily to finite fields. But it combines Lagrange's theorem with the theorem that $x^m=1$ has at most $m$ solutions in $F^*$ in a very simple way.

• I love this proof which furnishes an explicit generator. A slight variant of it consists in observing that if $x$ is chosen so that $x^{n/p}\neq 1$ (roughly one element over $p$ will do the job), then $x^{n/q}$ is of exact order $q$. The rest is as in Paul's answer.
– ACL
Dec 25, 2014 at 15:42
• On the face of it this uses right off the bat that $F$ is finite, which is not given. Unless $F^*$ is just a strange way of spelling $G$? Feb 13 at 12:58

I like the following explanation of the fact that if $G=\{g_0,\dots,g_{n-1}\}$ is your group, and $0<m<n$, then there exists $i$ for which $g_i^m\ne 1$:

otherwise the Vandermonde matrix $(g_i^j)$ would have two equal columns, thus zero determinant, but its determinant is $\prod (g_i-g_j)\ne 0$.

(After that we continue in usual way, with primary factors.)

The difference with the usual argument (the polynomial $x^m-1$ has degree $m$, hence at most $m$ roots) is that we replace this general fact by implementing its proof for a specific polynomial which we need. It may have some advantage in other questions around. For example, it allows to prove (by literally the same reasoning) the following generalization:

Let $R$ be a commutative ring with unity $e$. Assume that $G$ is a finite multiplicative subgroup of $R$ and for any $g \in G$, $g \ne e$, the element $e-g$ is not a zero divisor in $R$. Then group $G$ is cyclic.

• Very nice argument! What do you mean by "continue in usual way, with primary factors"? That the order of each element of a finite abelian group divides the maximal order of all elements in the group can be proved in a direct way, not requiring the cyclic decomposition of finite abelian groups or its refinements (primary decomposition, invariant factor decomposition). Nov 3, 2021 at 3:15
• I mean the following continuation: let $p_1,\ldots,p_k$ be all (distinct) prime divisors of $n=|G|$. We found $g_i$ such that $g_i^{n/p_i}\ne 1$ for all $i=1..k$. Denote $h_i=g_i^{\prod_{j\ne i} p_j}$. Then $h_i^{n/p_j}=1$ if and only if $i=j$. Thus $h:=h_1h_2\ldots h_k$ has order exactly $n$, since $h^{n/p_i}=h_i^{n/p_i}\ne 1$. Nov 3, 2021 at 6:20

In some sense this is similar to Andrea Ferretti's post and the comments below it, but with perhaps slightly different phrasing. (It is the proof I wrote up for the nLab some time back.)

As noted, if $$G$$ is a finite subgroup of $$K^\times$$, then the exponent $$e$$ of $$G$$ (the lcm of orders of its elements) equals the order $$m$$ since $$\prod_{g \in G} (x - g)$$ divides $$x^e - 1$$. So it remains to show that $$e = m$$ forces $$G$$ to be cyclic, i.e., that some element has order $$e$$.

Let $$e = p_1^{r_1} p_2^{r_2} \dotsm p_k^{r_k}$$. The exponent $$r_i$$ is the maximum multiplicity of $$p_i$$ occurring in orders of elements; any element realizing that maximum has order divisible by $$p_i^{r_i}$$, and then some power $$y_i$$ of that element has order exactly $$p_i^{r_i}$$. By the following lemma and induction, $$\prod_{i=1}^k y_i$$ has order $$e$$.

Lemma: If $$m, n$$ are relatively prime and $$x$$ has order $$m$$ and $$y$$ order $$n$$ in an abelian group, then $$xy$$ has order $$mn$$.

Proof: Suppose $$(x y)^k = x^k y^k = 1$$. For some $$a$$, $$b$$ we have $$a m - b n = 1$$, and so $$1 = x^{k a m} y^{k a m} = y^{k a m} = y^k y^{k b n} = y^k$$. It follows that $$n$$ divides $$k$$. Similarly $$m$$ divides $$k$$, so $$m n = \operatorname{lcm}(m, n)$$ divides $$k$$, as desired.

I know less than you know in the topic since you are a teacher now.
However, I want to mention two sources you can find the proof which use little prerequisites of algebra.
First of all, the classic Basic Number Theory by André Weil contains a proof in the first section of the first chapter which uses a great method.
As for the second, the Chinese mathematician Hua, Lo-keng (in Chinese: 華羅庚) has published a book entitled Introduction to number theory, which has a proof that uses only elementary techniques, and I hope it is exactly what you need.
By the way, the first approach is the same as that mentioned by @QiaoChu Yuan in some sense, and the second is mostly elementary.

• Weil's proof in Basic Number Theory is indeed short and sweet. In his Number Theory for Beginners (a gem of a book!) the proof is the standard one, similar to Serre's.
– lhf
Feb 8, 2011 at 12:38
• If it's so short and sweet, how about sharing it with us? Unfortunately, Weil isn't on my bookshelf. Feb 8, 2011 at 22:50
• @Kevin: Amazon's Look Inside allows you to read page 2, which is where the proof is. See First Pages.
– lhf
Feb 22, 2011 at 12:33
• @Kevin: I think I can give you a brief guide to the proof as follows: First of all, we all know that a pure polynomial can have no more roots than the degree. Then suppose a is an element in the group which has the maximal order, we can show that if an element of the group is not of the order dividing that of a, then there exists an element of order greater than that of a, hence every element is a root of $x^{n}=1$ where n is the order of a, and hence by what we have shown, every element is a power of a, which is what we want to prove. My post is a supplement, please forgive any flaw. Feb 24, 2011 at 9:40
• I just noticed that the book is available in amazon, if you are lazy to view that book in person, then this post serves as a brief guide, which does not catch any spirits of the original proof. Feb 24, 2011 at 9:42

I don't know how helpful this is for anybody, especially students, but for finite subgroups $G$ of $\mathbb C^*$ you can first observe that every element has modulus $1$, so is on the unit circle and has rational argument, and then choose the element $z$ of least non-zero argument. Then, given $y\in G$, rotate clockwise by dividing by powers of $z$ until the argument lies below that of $z$; this shows that $y$ is a power of $z$.

• The application is probably to finite fields. Feb 8, 2011 at 19:11
• Well, my point was more this: here's an example where we can see the result concretely before we go on to the general case (in the OP the field was unspecified). Sometimes (depending on the audience) this approach makes things easier. Feb 8, 2011 at 20:24

Lemma: Let $G$ be a finite abelian group, and let $x\in G$ with maximal order. Then for any other element of $y\in G$, $|y|$ divides $|x|$.

Proof. If not, then there is an element $y\in G$ and a prime $p$ such that
$$|x|= p^a u \qquad |y| = p^b v$$ with $(p,u)=(p,v) = 1$ and $a< b$. In this case, we have $|x^{p^a}| = u$ and $|y^v| = p^b$. Since these orders are relatively prime (and the group is abelian),
$$|x^{p^a}y^v| = |x^{p^a}|\cdot |y^v| = p^b u > p^au = |x|.$$

Now apply this to our subgroup $G\subseteq F^*$. Let $x\in G$ have maximal order $n$, so that $n \leq |G|$. The Lemma implies that there are at least $|G|$ roots to the polynomial $x^n-1$ in the field $F$, and of course there are at most $n$ roots to $x^n - 1$. Thus $$n \leq |G| \leq \fbox{number of roots of x^n-1} \leq n .$$

• Fixed my argument at long last. Notice we don't need the classification for this. May 5, 2017 at 13:58

I actually think it will not be so easy to say when two proofs of this result will be "distinctly different": rather I expect most or all will have common features, including using at least a little bit of group theory.

For instance, the proof I wrote up for my elementary(ish) number theory course is Theorem 9 in these notes. The notes themselves are on finite commutative groups, and Theorem 9 is on page 3, in the section on "cyclic groups". Prior to the statement and proof, a little over a page is spent developing the basic properties of cyclic groups, including a statement involving the Euler $$\varphi$$-function. The proof of the result itself -- which, note, is a criterion for an a priori noncommutative finite group to be cyclic -- occupies $$11$$ lines. (Added: sorry, false advertising -- add two more lines to get from Theorem 9 to Corollary 10, which is the statement that any finite subgroup of the multiplicative group of a field is cyclic.) I certainly think it is more or less the proof that any research mathematician is expecting to find.

Let me mention though that I had originally included this argument as an application of the Mobius Inversion Formula. After having looked back at what I'd done, I decided that although the argument was reminiscent of an inversion / inclusion-exclusion counting argument, it only made it more complicated to phrase it in that way.

• After checking back in Serre's Course of Arithmetic, it seems that the proof in the notes I linked to is all but identical to the one in Serre's book (what a coincidence!). So I guess my answer amounts to a defense of his proof: it seems perfectly lovely to me. (Interestingly, a semester of abstract algebra was a prerequisite for my course, but that one semester does not cover groups. So my solution was to write up some notes on the basic group theory that would be needed in my course.) Feb 8, 2011 at 9:55
• This is the proof from Gauss's Disquisitiones. Feb 8, 2011 at 15:26
• This is the proof that I used when I was teaching Algebra, but the students always had trouble grasping it. This of course may be a comment on my teaching, not the excellence of the proof, which I continue to proclaim. Dec 25, 2014 at 18:17
• For the record: The theorems and proofs mentioned in this answer are probably in Section B.2 of math.uga.edu/~pete/4400FULL.pdf nowadays. Apr 19, 2016 at 23:10
• (BTW @PeteL.Clark: Care to check that you don't have several equations labeled identically (logfile warning: "LaTeX Warning: Label `[name of your label]' multiply defined.") in your tex source? On page 8, "Theorem 140" and "Theorem 142" are mentioned, but probably refer to Theorems 7 and 8. This is a particularly easy mistake to make when you are including many texs in a single file.) Apr 19, 2016 at 23:14

Weil: "Basic Number Theory"

Chapter I

Lemma 1. If K is a commutative field, every finite subgroup of Kˣ is cyclic.

In fact, let Γ be such a group, or, what amounts to the same, a finite subgroup of the group of all roots of 1 in K. For every n ≥ 1, there are at most n roots of xⁿ = 1 in K, hence in Γ; we will show that every finite commutative group with that property is cyclic.

Let α be an element of Γ of maximal order N. Let β be any element of Γ, and call n it's order. If n does not divide N, there is a prime p and a power q = pᵛ of p such that q divides n and not N. Then one verifies at once that the order of αβn/q is the l.c.m. of N and q, so that it is > N, which contradicts the definition of N. Therefore n divides N. Now xⁿ = 1 has the n distinct roots αkN/n in Γ, with 0 ≤ k < n; as β is a root of xⁿ = 1, it must be one of these. This shows that α generates Γ.

• Note that this has been listed already. Apr 19, 2016 at 21:54
• Re, specifically, by @awllower. Feb 13 at 23:10

Here's my version of a proof, which seems to me to be very elementary. I'll prove the following assertion, which clearly applies to finite subgroups of the multiplicative group of a field:

Let $$G$$ be a finite abelian group such that, for every prime $$p$$, there are at most $$p$$ elements $$g\in G$$ satisfying $$g^p=1$$. Then $$G$$ is cyclic.

I argue by induction on $$n=|G|$$. So let $$G$$ be a non-trivial group satisfying the hypothesis. Then there exists an element of $$G$$ with order $$>1$$, and hence (by taking an appropriate power) an element of $$G$$ with order $$p$$ for some prime $$p$$. The main observation I will use is that the $$p$$th power map on $$G$$ is a homomorphism, and therefore defines a $$p$$-to-$$1$$ surjective function $$\phi\colon G\to G^p$$ (as the hypothesis on $$G$$ implies that the kernel of $$\phi$$ must have order $$p$$.)

The subgroup $$G^p$$ has order $$n/p, and being a subgroup of $$G$$ also satisfies the hypothesis, so by induction is cyclic on some generator $$a\in G^p$$. I will show the following: there exists $$b\in G\smallsetminus G^p$$ such that $$b^p=a$$. Given this it is straightforward to verify that $$b$$ has order $$n$$ (using that $$G/G^p$$ has prime order so is cyclic), whence $$G$$ is cyclic.

There are two cases, depending on the behavior of the restriction of the $$p$$th power map to $$G^p$$, which gives a surjective homomorphism $$\phi|_{G^p}\colon G^p\to G^{p^2}$$.

1. $$G^{p^2}=G^p$$, so $$\phi|_{G^p}\colon G^p\to G^p$$ is a bijection. Therefore the restriction $$\phi|_{G\smallsetminus G^p}$$ of the $$p$$th power map to the complement of $$G^p$$ is a $$(p-1)$$-to-$$1$$ surjective function $$G\smallsetminus G^p\to G^p$$. In particular $$a=b^p$$ for some $$b\in G\smallsetminus G^p$$ as desired.

2. $$G^{p^2}\neq G^p$$. Therefore $$\phi|_{G^p}\colon G^p\to G^{p^2}$$ is a surjective $$p$$-to-$$1$$ map. Since $$\phi\colon G\to G^p$$ is surjective and $$p$$-to-$$1$$, it follows that the restriction $$\phi|_{G\smallsetminus G^p}$$ of the $$p$$th power map to the complement of $$G^p$$ is a $$p$$-to-$$1$$ surjective function $$G\smallsetminus G^p\to G^p\smallsetminus G^{p^2}$$. The generator $$a$$ of $$G^p$$ cannot be in the proper subgroup $$G^{p^2}$$, so $$a=b^p$$ for some $$b\in G\smallsetminus G^p$$ as desired.

Here is a proof that $$\mathbb F_q^\times$$ is cyclic. Let the finite extension $$F/\mathbb Q_p$$ have residue field $$\mathbb F_q$$. The group $$\mu_{q-1}=\{x\in F:x^{q-1}=1\}$$ is isomorphic to $$\mathbb F_q^\times$$ by Hensel's lemma.

By choosing an embedding $$F\hookrightarrow\mathbb C$$, the group $$\mu_{q-1}$$ can be identified with $$\{x\in\mathbb C:x^{q-1}=1\}$$. But this is cyclic with generator $$e^{2\pi i/(q-1)}$$.

• Your approach, in the case of prime $p$, appeared in Matt Baker’s blog in 2013: mattbaker.blog/2013/11/07/…. A simplification suggested by his argument is not to embed the whole field $F$ (a finite extension of $\mathbf Q_p$) into $\mathbf C$, which is extremely non-constructive, but only embed its subfield $H = \mathbf Q(\mu_{q-1})$ into $\mathbf C$. That achieves what you need and is only mildly non-constructive (two splitting fields of $x^{q-1}-1$ over $\mathbf Q$ are isomorphic). Jan 13 at 17:54
• This approach does not obviously generalise to handle all finite subgroups of (possibly infinite) fields, does it? Feb 13 at 22:50
• The argument certainly handles all fields of positive characteristic, as XYC points out below. Feb 23 at 1:50

This approach goes along elementary ideas. But the proof using the power group homomorphism and the size estimate of the kernel and the image using number of the polynomial roots is much more elegant and simple.

The number $m$ of elements of a subgroup $H$ divides the number $n$ of elements of a group $G$. It simply follows by freely acting by translation with the subgroup on the group (number of the orbits times the number of elements in the subgroup gives the number of elements in the group). The order $k$ of any element is the size of the subgroup generated by that element, therefore $k$ divides $n$. In particular, for any $g$ in $G$, $g^n=1$ (well known!).

Lemma 1. Let $a$ be an element of order $u$ and $b$ an element of order $v$ in $G$ (commutative). If nothing but $1$ divides both $u$ and $v$, then:

(I) the intersection of the two groups generated by $a$ and $b$ contains $1$ and nothing more.

(II) the order of the product $a b$ equals the product $u v.$

Proof: (I) the intersection being a subgroup of both cyclic groups, the number of the elements of the intersection should divide both $u$ and $v$.

(II) $(a b)^{u v}= 1 = (a^u)^v (b^v)^u$, hence the order $l$ of $a b$ is a divisor of $u v$. Also $a^l b^l =1$, hence $a^l=b^{-l}$. From (I) above we get $a^l=1$ and $b^l=1$; hence $u$ and $v$ divide $l$. Therefore $l = u v$.

Lemma 2. If $a$ has order $u$ and $u = w t$ then $c=a^w$ has order $t$ . (obvious).

Using the above results I want to show that:

Prop 1. In a commutative group that is not cyclic there are two distinct cyclic subgroups of the same order (with some elements in both).

Corollary. In a commutative group that is not cyclic, for some integer $w$ there are $w+1$ distinct elements $h$ with the property $h^w=1$.

Proof: Suppose $a$ is chosen in $G$ such it has the highest possible order $m$ and $m < n$ (the number of elements in $G$). Take $b\neq a^i$, i.e. $b$ is not in the group generated by $a$; suppose $b$ has order $k$. We show that $k$ divides $m$. If $k$ has a divisor $p^j$ ($p$ prime) that does not divide $m$ (this means either $p$ does not divide $m$ or the power $j$ is higher than the power of $p$ dividing $m$), using the results above we can build a new element having order $w >= p m$ (first, using lemma 2, raise $a$ to a power that takes out $p$ from its order, second raise $b$ to a power that takes out all primes except $p$ from its order and finally, using lemma 1(II), multiply the two elements), which contradicts how $a$ was chosen.

Therefore $k$ divides $m$ and $a_0=a^{m/k}$ generates a group of order $k$ as $b$ does. Moreover $b$ is not in that subgroup. These are the subgroups looked for.

Prop 2. Suppose $G$ is a finite group (with respect to multiplication) inside a field. Then $G$ is cyclic.

If $G$ is not cyclic, using Corollary above we get an integer $w$ for which $X^w-1$ has $w+1$ roots. Since we are in a field, this is impossible, as for every root $r$ of a polynomial we get a factor $(X-r)$ of that polynomial. And a polynomial of degree $d$ cannot have more than $d$ factors.

• I took the liberty of fixing the LaTex; I hope it's fine Dec 2, 2016 at 10:23
• Just to have it said, your Lemma I(1) does not require that $G$ is commutative. Feb 13 at 22:57

The multiplicative group of a finite field $$F$$ with $$n$$ elements has at most $$d$$ solutions of $$x^{d} = 1$$ for each divisor $$d$$ of $$n.$$ It is proved ( or maybe is an exercise) in Herstein's "Topics in Algebra" that a finite group $$G$$ of order $$n$$ which has at most $$d$$ solutions of $$x^{d} = 1$$ for each divisor $$d$$ of $$|G|,$$ then $$G$$ is cyclic (it is not assumed that $$G$$ is Abelian). Later edit: Here is a proof of this fact which occurred to me six years later. It is not much more difficult in the non-Abelian case, but depending on the intended audience, it can be simplified just to deal with the Abelian case. I have deliberately avoided using Sylow's Theorem, though it can be much simplified in Sylow's Theorem is allowed to be used. Let $$G$$ be a finite group of order $$n$$ which contains at most $$d$$ solutions of $$x^{d} = 1$$ for every divisor $$d$$ of $$n$$. We wish to prove that $$G$$ is cyclic.

By induction, we may suppose that every proper subgroup of $$G$$ is cyclic. Next, we note that every subgroup of $$G$$ is normal in $$G$$. Let $$H$$ be a proper subgroup of $$G$$. Then $$H$$ contains $$|H|$$ solutions of $$x^{|H|} = 1$$, so $$H$$ is exactly the set of solutions of $$x^{|H|} = 1$$ in $$G$$. But for any $$g \in G$$, $$g^{-1}Hg$$ is another subgroup of $$G$$ of order $$|H|$$ which also contains $$|H|$$ solutions of $$x^{|H|} = 1$$. Hence $$g^{-1}Hg = H$$ and $$H \lhd G$$.

Now whenever $$A,B$$ are subgroups of $$G$$, we have $$AB = BA$$ and so $$AB$$ is a subgroup of $$G$$ of order $$\frac{|A||B|}{|A \cap B|}.$$ A proper subgroup $$H$$ of $$G$$ is said to be maximal if $$H$$ is not strictly contained in any proper subgroup of $$G$$.

Now every maximal subgroup of $$G$$ has prime index. For let $$H$$ be a maximal subgroup of $$G$$ and let $$x \in G-H$$ be of minimal order. Then $$x \neq 1,$$ so choose a prime divisor $$p$$ of the order of $$x$$. Than $$x^{p} \in H$$, so that $$G = H\langle x \rangle$$ and $$|G| = \frac{|H||\langle x \rangle|}{|\langle x^{p} \rangle |} = p|H|.$$

Now $$H$$ is cyclic, so has a subgroup of order $$d$$ for each divisor $$d$$ of $$|H|$$. Let $$p^{r}$$ be the largest power of $$p$$ dividing $$|H|$$. Then $$p^{r} \geq |\langle x^{p} \rangle|$$ and $$H$$ has a unique subgroup $$K$$ of order $$p^{r}.$$ If $$p^{r} > |\langle x^{p} \rangle|$$ then $$x \in K$$ since $$G$$ has a unique subgroup of order $$p^{r}.$$ This contradicts $$x \not \in H.$$ Thus $$p^{r} = \frac{|\langle x \rangle | }{p}.$$

Let $$L$$ be a subgroup of $$H$$ of order $$\frac{|H|}{p^{r}}$$ which we now know is coprime to $$p$$. Then $$|G| = |L| |\langle x \rangle|$$ and $$L \cap \langle x \rangle = 1$$. Since $$L \lhd G$$ and $$\langle x \rangle \lhd G$$, we have $$G \cong L \times \langle x \rangle$$ which is cyclic (generated by $$\ell x$$, where $$\ell$$ is a generator of $$L).$$

• To emphasize $G$ may be nonabelian above, let me show the argument is shorter if we say $G$ is abelian (that fits the application). For abelian $G$, if $g$ has maximal order and we want $G = \langle g\rangle$, let $h$ be an element of $G$, $h$ have order $d$, and $g$ have order $m$. Since $G$ is abelian, $d \mid m$ (this is often false for nonabelian groups). Then $h$ and $g^{m/d}$ have order $d$, so $x^d = 1$ has $d$ solutions as $\langle h\rangle$ and $\langle g^{m/d}\rangle$. Those subgroups agree, so $h \in \langle g^{m/d}\rangle \subset \langle g\rangle$. Thus $G = \langle g\rangle$. Dec 1, 2022 at 1:32
• @KConrad I think the advantage of assuming $G$ Abelian is somewhat of a non-issue here, since combinatorics beats algebra in this case. If $G$ contains no more cyclic subgroups of any given order than the cyclic group $C$ of order $n=|G|$ does, namely $1$ for every order allowed by Lagrange's theorem, then it has no more elements of any given order than $C$ does, so $G$ cannot account for all its $n$ elements without having an element of order$~n$. Feb 14 at 13:04

First off, this only requires $$F$$ to be an integral domain, and not because one can form its field of fractions, but because division is never used (other than Euclidean division by monic polynomials in $$F[X]$$). Like virtually all proofs listed, this one hinges on two statements, which I'll formulate as limited/specific as possible: (1) for any $$d>0$$ there are at most $$d$$ distinct elements $$x\in F$$ satisfying $$x^d=1$$, and (2) a finite group that has at most one cyclic subgroup of any given order is itself cyclic. I will need some really easy facts that I won't stoop down to prove here: substitution $$X:=x$$ defines a ring morphism $$F[X]\to F$$ for any $$x\in F$$ sending any polynomial to the remainder in its Euclidean division by $$X-x$$; any element of $$G$$ generates a cyclic subgroup of$$~G$$ that has order dividing the order $$n$$ of $$G$$ (an instance of Lagrange's theorem); and finally cyclic groups of any positive order$$~m$$ exist, they are all isomorphic, and they have exactly one subgroup of order$$~d$$ whenever $$d$$ divides$$~m$$. Apart from this I will try to be really elementary; I won't mention Euler's totient function by name (but it's there), and I don't think I even use unique factorisation of integers.

Clearly (1) and (2) combine to show $$G$$ is cyclic: $$G$$ must satisfy the hypothesis of (2), since more that one cyclic subgroup of order $$d$$ will produce (in their union) more than $$d$$ solutions to $$x^d=1$$.

To prove (1), first note that in $$F[X]$$ the leading term of any product of non-zero elements $$P,Q$$ is the product of their leading terms, so $$\deg(PQ)=\deg(P)\deg(Q)$$, and if $$PQ$$ is monic we can modify $$P$$ and $$Q$$ by invertible scalars if necessary to make them monic as well. One can then (by induction on the degree) decompose $$X^d-1=P_1\ldots P_k$$ as a product of monic non-constant irreducible factors $$P_i$$ (irreducibility being the impossibility to decompose further). By degree consideration $$k\leq d$$. For $$x\in F$$ the evaluation $$X:=x$$ produces a product in $$F$$ of the remainders of the $$P_i$$ divided by $$X-x$$, a remainder that is zero only if $$P_i=X-x$$. Since $$F$$ is an integral domain, this must happen for at least one $$i$$ for every $$x\in F$$ with $$x^d=1$$, and this can happen for at most $$k\leq d$$ different values$$~x$$.

To prove (2), compare $$G$$ with the cyclic group $$C$$ of same order$$~n$$. By the hypothesis (and mentioned prerequisites) $$G$$ contains no more cyclic subgroups of any given order than $$C$$ does. Since the number of generators of a cyclic subgroup depends only on the order of that subgroup, $$G$$ contains no more elements of any given order than $$C$$ does. But the fact that $$G$$ and $$C$$ both have $$n$$ elements then implies that we have equalities all along; in particular $$G$$, like $$C$$, has a cyclic subgroup of order$$~n$$, which of course is $$G$$.

• As we discussed in the comments, I find it hard to say whether a fact about integral domains is because you can embed in a field, or ‘only’ because of domain-ness. As far as I can tell, there's no way logically to disentangle which one of these facts about a ring you are using, since they are equivalent. (For example, I find it more intuitive to prove additivity of degree for fields, and deduce it for integral domains as a special case; but I think there's no meaningful sense in which either approach is wrong.) Do you have in mind a more general setting where they are not equivalent? Feb 13 at 22:49
• @LSpice What is natural or intuitive is of course a matter of taste. It may be more convenient to work over a field since one is more at ease, not having to think a lot which tools can or cannot be used. Over a field one can reduce to the monic case to see additivity of degrees, but if you look at what makes the argument tick, it is "leading term of product is product of leading terms" and the reduction to monic was unnecessary; integrality is what matters. I've spelled out that what limits the number of distinct roots is that to zero a product one must zero a factor.... Feb 14 at 9:07
• ...I believe that if you take any reasonable proof of (1) (or the more general statement about roots) and flesh it out to see what it really uses, then the proof will turn out to work just as easily over any integral domain. So it is not that I have in mind applications where reduction to a field would not work, it is just Occam's razor: why invoke an unhelpful hypothesis limiting the scope, needing an extra step (however obvious to cognoscenti) to recover the more general case, if one can simply do without? Call me a Bourbakist if you like. Feb 14 at 9:14

As for me a thorough answer would be to consider the characteristic of the field $$F$$.

If $$\operatorname{char} F>0$$, then the finite group $$G$$ will be contained in a finite field $$\mathbb{F}_q$$, whose multiplicative group is cyclic, then so is its subgroup.

If $$\operatorname{char} F=0$$, then $$G$$ is contained in $$\overline{\mathbb{Q}}$$ and an element is of form $$e^{\frac{q}{p}2\pi i}$$ where $$\frac{q}{p}\in\mathbb{Q}/\mathbb{Z}$$. So it suffices to show that a finite subgroup $$H$$ of $$\mathbb{Q}/\mathbb{Z}$$ is cyclic. If $$H=\{\frac{q_1}{p_1},\dotsc,\frac{q_n}{p_n}\}$$, then it's a subgroup of the cyclic group generated by $$\frac{1}{\prod\limits_{i=1}^np_i}$$ hence is cyclic.

• At the level of the students under discussion, I think that the question of cyclicity of multiplicative groups of finite fields is something that also needs proof. Feb 14 at 19:14
• @LSpice : Yes you are right. I just found that the multiplicative group of a finite group is cyclic may require the structure theorem of finite abelian groups. But once we apply this theorem then there's no need to consider the char. Since then a non-cyclic $G$ admits a direct summand of form $\mathbb{Z}/p^a\oplus\mathbb{Z}/p^b,1\leq a\leq b$ and this gives $p^{a+b}$ distinct solutions to $x^{p^b}=1$.
– XYC
Feb 15 at 8:03

For the field $${\bf{Z}}/(p)$$, we can argue this way. Suppose there is $$K\le({\bf{Z}}/(p))^\times$$ such that $$K\cong C_q\times C_q$$, for some prime $$q$$. Therefore, there are $$q^2$$ elements $$x\in({\bf{Z}}/(p))^\times$$ such that $$x^q\equiv 1\pmod p$$: a contradiction, because this equation has at most $$q$$ solutions in $${\bf{Z}}/(p)$$. So, $$({\bf{Z}}/(p))^\times$$ does not contain any subgroup isomorphic to $$C_q\times C_q$$, for any prime $$q$$. For this characterization of the non-cyclic finite abelian groups, $$({\bf{Z}}/(p))^\times$$ is cyclic.