ALGEBRAIC NUMBER THEORY

J.S. Milne

August 14, 1996; v2.01

Abstract. These are the notes for Math 676, University of Michigan, Fall 1992, exactly as they were handed out during the course except for some minor corrections.

Please send comments or corrections to me at jmilne@umich.edu using “Math676” as the subject.

Contents

0. Introduction . . . . . . . . . . . . . . . . . . . . 1

1. Preliminaries From Commutative Algebra . . . . . . 10 Basic definitions . . . . . . . . . . . . . . . . . . 10 Noetherian rings . . . . . . . . . . . . . . . . . . 10 Local rings . . . . . . . . . . . . . . . . . . . . 12 Rings of fractions . . . . . . . . . . . . . . . . . 12 The Chinese remainder theorem . . . . . . . . . . . 14 Review of tensor products . . . . . . . . . . . . . 15

2. Rings of Integers . . . . . . . . . . . . . . . . . 20 Symmetric polynomials . . . . . . . . . . . . . . . 20 Integral elements . . . . . . . . . . . . . . . . . 21 Review of bases of A-modules . . . . . . . . . . . . 26 Review of norms and traces . . . . . . . . . . . . . 27 Review of bilinear forms . . . . . . . . . . . . . . 28 Discriminants . . . . . . . . . . . . . . . . . . . 28 Rings of integers are finitely generated . . . . . . . . 31 Finding the ring of integers . . . . . . . . . . . . . 32 Algorithms for finding the ring of integers . . . . . . . 36

3. Dedekind Domains; Factorization . . . . . . . . . . 41 Discrete valuation rings . . . . . . . . . . . . . . . 41 Dedekind domains . . . . . . . . . . . . . . . . . 42 Unique factorization . . . . . . . . . . . . . . . . 43 The ideal class group . . . . . . . . . . . . . . . . 48 Discrete valuations . . . . . . . . . . . . . . . . . 51 Integral closures of Dedekind domains . . . . . . . . 52 Modules over Dedekind domains . . . . . . . . . . . 53 Factorization in extensions . . . . . . . . . . . . . 54 The primes that ramify . . . . . . . . . . . . . . . 56 Finding factorizations . . . . . . . . . . . . . . . 58 Examples of factorizations . . . . . . . . . . . . . 59 Eisenstein extensions . . . . . . . . . . . . . . . . 62

\begin{matrix}c \\ ◯ \end{matrix} 1996 J.S. Milne. You may make one copy of these notes for your own personal use.

4. The Finiteness of the Class Number . . . . . . . . . 63 Norms of ideals . . . . . . . . . . . . . . . . . . 63 Statement of the main theorem and its consequences . . 65 Lattices . . . . . . . . . . . . . . . . . . . . . 68 Some calculus . . . . . . . . . . . . . . . . . . . 72 Finiteness of the class number . . . . . . . . . . . . 75 Binary quadratic forms . . . . . . . . . . . . . . . 77

5. The Unit Theorem . . . . . . . . . . . . . . . . . 80 Statement of the theorem . . . . . . . . . . . . . . 80 Proof that U_{K} is finitely generated . . . . . . . . . . 81 Computation of the rank . . . . . . . . . . . . . . 82 S-units . . . . . . . . . . . . . . . . . . . . . 85 Finding fundamental units in real quadratic fields … 85 Units in cubic fields with negative discriminant …. 86 Finding μ(K) . . . . . . . . . . . . . . . . . . . 88 Finding a system of fundamental units . . . . . . . . 88 Regulators . . . . . . . . . . . . . . . . . . . . 89

6. Cyclotomic Extensions; Fermat’s Last Theorem …. 90 The basic results . . . . . . . . . . . . . . . . . 90 Class numbers of cyclotomic fields . . . . . . . . . . 96 Units in cyclotomic fields . . . . . . . . . . . . . . 96 Fermat’s last theorem . . . . . . . . . . . . . . . 97

7. Valuations; Local Fields . . . . . . . . . . . . . . 100 Valuations . . . . . . . . . . . . . . . . . . . . 100 Nonarchimedean valuations . . . . . . . . . . . . . 100 Equivalent valuations . . . . . . . . . . . . . . . 102 Properties of discrete valuations . . . . . . . . . . . 104 Complete list of valuations for ℚ . . . . . . . . . . . 104 The primes of a number field . . . . . . . . . . . . 106 Completions . . . . . . . . . . . . . . . . . . . 108 Completions in the nonarchimedean case . . . . . . . 109 Newton’s lemma . . . . . . . . . . . . . . . . . . 112 Extensions of nonarchimedean valuations . . . . . . . 116 Newton’s polygon . . . . . . . . . . . . . . . . . 118 Locally compact fields . . . . . . . . . . . . . . . 119 Unramified extensions of a local field . . . . . . . . . 121 Totally ramified extensions of K . . . . . . . . . . . 123 Ramification groups . . . . . . . . . . . . . . . . 124 Krasner’s lemma and applications* . . . . . . . . . . 125

8. Global Fields . . . . . . . . . . . . . . . . . . . 128 Extending valuations . . . . . . . . . . . . . . . . 128 The product formula . . . . . . . . . . . . . . . . 130 Decomposition groups . . . . . . . . . . . . . . . 131 The Frobenius element . . . . . . . . . . . . . . . 134 Examples . . . . . . . . . . . . . . . . . . . . . 135 Computing Galois groups (the hard way) . . . . . . . 136 Computing Galois groups (the easy way) . . . . . . . 137 Applications of the Chebotarev density theorem …. 142 Topics not covered* . . . . . . . . . . . . . . . . 143

Introduction

An algebraic number field is a finite extension of ℚ; an algebraic number is an element of an algebraic number field. Algebraic number theory studies the arithmetic of algebraic number fields—the ring of integers in the number field, the ideals in the ring of integers, the units, the extent to which the ring of integers fails to be have unique factorization, and so on. One important tool for this is “localization”, in which we complete the number field relative to a metric attached to a prime ideal of the number field. The completed field is called a local field–its arithmetic is much simpler than that of the number field, and sometimes we can answer questions by first solving them locally, that is, in the local fields.

An abelian extension of a field is a Galois extension of the field with abelian Galois group. Global class field theory classifies the abelian extensions of a number field K in terms of the arithmetic of K; local class field theory does the same for local fields.

Math 676 will be concerned with algebraic number theory; Math 776 next term will be concerned with class field theory.

I now give a quick sketch of what the course will cover. The fundamental theorem of arithmetic says that integers can be uniquely factored into products of prime powers: an m ≠ 0 in ℤ can be written in the form,

m = up_{1}^{r_{1}} ⋯ p_{n}^{r_{n}}, u = ±1, p_{i} prime number, r_{i} > 0,

and this factorization is essentially unique.

Consider more generally an integral domain A. An element a ∈ A is said to be a unit if it has an inverse in A; I write A^{×} for the multiplicative group of units in A. An element p of A is said to prime if it is neither zero nor a unit, and if

p|ab ⟹ p|a or p|b.

If A is a principal ideal domain, then every nonzero nonunit element a of A can be written in the form,

a = p_{1}^{r_{1}} ⋯ p_{n}^{r_{n}}, p_{i} prime element, r_{i} > 0,

and the factorization is unique up to order and replacing each p_{i} with an associate, i.e., with its product with a unit.

Our first task will be to discover to what extent unique factorization (fails) to hold in number fields. Three problems present themselves. First, factorization in a field only makes sense with respect to a subring, and so we must define the “ring of integers” O_{K} in our number field K. Secondly, since unique factorization will in general fail, we shall need to find a way of measuring how much it fails. Finally, since factorization is only considered up to units, in order to fully understand the arithmetic of K, we need to understand the structure of the group of units U_{K} in O_{K}. Resolving these three problems will occupy the first half of the course.

The ring of integers. Let K be an algebraic number field. Because K is of finite degree over ℚ, every element α of K is a root of a monic polynomial

f(X) = X^{n} + a_{1}X^{n−1} + ⋯ + a_{0}, a_{i} ∈ ℚ.

If α is a root of a monic polynomial with integer coefficients, then α is called an algebraic integer of K. We shall see that the algebraic integers form a subring O_{K} of K.

The criterion as stated is difficult to apply. We shall see that to prove that α is an algebraic integer, it suffices to check that its minimum polynomial (relative to ℚ) has integer coefficients.

Consider for example the field K = ℚ[\sqrt{d]}, where d is a square-free integer. The minimum polynomial of α = a + b\sqrt{d}, b ≠ 0, a, b ∈ ℚ, is

(X − (a + b\sqrt{d}))(X − (a − b\sqrt{d})) = X^{2} − 2aX + (a^{2} − b^{2}d).

Thus α is an algebraic integer if and only if

2a ∈ ℤ, a^{2} − b^{2}d ∈ ℤ.

From this it follows easily that

O_{K} = ℤ[\sqrt{d}] = \{m + n\sqrt{d} | m, n ∈ ℤ\} if d ≡ 2, 3 mod 4,

and

O_{K} = \{m + n\frac{1 + \sqrt{d}}{2} | m, n ∈ ℤ\} if d ≡ 1 mod 4,

i.e., O_{K} is the set of sums m′ + n′\sqrt{d} with m′ and n′ either both integers or both half-integers.

Let ζ_{d} be a primitive d^{th} root of 1, for example, ζ_{d} = exp(2πi/d), and let K = ℚ[ζ_{d}]. Then we shall see that

O_{K} = ℤ[ζ_{d}] = {∑ m_{i}ζ_{d}^{i} | m_{i} ∈ ℤ}.

Factorization. An element p of an integral domain A is said to be irreducible if it is neither zero nor a unit, and can’t be written as a product of two nonunits. For example, a prime element is (obviously) irreducible. A ring A is a unique factorization domain if every nonzero nonunit element of A can be expressed as a product of irreducible elements in essentially one way. Is O_{K} a unique factorization domain? No, not in general!

In fact, we shall see that each element of O_{K} can be written as a product of irreducible elements (this is true for all Noetherian rings)—it is the uniqueness that fails.

For example, in ℤ[\sqrt{−5}] we have

6 = 2 · 3 = (1 + \sqrt{−5})(1 − \sqrt{−5}).

To see that 2, 3, 1 + \sqrt{−5}, 1 − \sqrt{−5} are irreducible, and no two are associates, we use the norm map

Nm : ℚ[\sqrt{−5}] → ℚ, a + b\sqrt{−5} ↦ a^{2} + 5b^{2}.

For α ∈ O_{K}, we have

Nm(α) = 1 ⟺ αᾱ = 1 ⟺ α is a unit.  (*)

If 1 + \sqrt{−5} = αβ, then Nm(αβ) = Nm(1 + \sqrt{−5}) = 6. Thus Nm(α) = 1, 2, 3, or 6. In the first case, α is a unit, the second and third cases can’t occur, and in the fourth case, β is a unit. Similarly show that 2, 3, and 1−\sqrt{−5} are irreducible. Next note that (*) implies that associates have the same norm, and so it remains to show that 1 + \sqrt{−5} and 1 − \sqrt{−5} are not associates, but

1 + \sqrt{−5} = (a + b\sqrt{−5})(1 − \sqrt{−5})

has no solution with a, b ∈ ℤ.

The problem is that irreducible elements in O_{K} need not be prime. In the above example, 1 + \sqrt{−5} divides 2 · 3 but it divides neither 2 nor 3. In fact, in an integral domain in which factorizations exist (e.g. a Noetherian ring), factorization is unique if all irreducible elements are prime.

What can we recover? Consider

210 = 6 · 35 = 10 · 21.

If we were naive, we might say this shows factorization is not unique in ℤ; instead, we recognize that there is a unique factorization underlying these two decompositions:

210 = (2 · 3)(5 · 7) = (2 · 5)(3 · 7).

The idea of Kummer and Dedekind was to enlarge the set of “prime numbers” so that, for example, in ℤ[\sqrt{−5}] there is a unique factorization,

6 = (𝔭_{1} · 𝔭_{2})(𝔭_{3} · 𝔭_{4}) = (𝔭_{1} · 𝔭_{3})(𝔭_{2} · 𝔭_{4}),

underlying the above factorization; here the 𝔭_{i} are “ideal prime factors”.

How do we define “ideal factors”. Clearly, an ideal factor should be characterized by the integers it divides. Moreover divisibility by 𝔞 should have the following properties:

𝔞|0; 𝔞|a, 𝔞|b ⟹ 𝔞|a ± b; 𝔞|a ⟹ 𝔞|ab for all b ∈ O_{K}.

If in addition division by 𝔞 has the property that

𝔞|ab ⟹ 𝔞|a or 𝔞|b,

then we call 𝔞 a “prime ideal factor”. Since all we know about an ideal factor is the set of elements it divides, we may as well identify it with this set. Thus an ideal factor is a set of elements 𝔞 ⊂ O_{K} such that

0 ∈ 𝔞; a, b ∈ 𝔞 ⟹ a ± b ∈ 𝔞; a ∈ 𝔞 ⟹ ab ∈ 𝔞 for all b ∈ O_{K};

it is prime if an addition,

ab ∈ 𝔞 ⟹ a ∈ 𝔞 or b ∈ 𝔞.

Many of you will recognize that an ideal factor is what we now call an ideal, and a prime ideal factor is a prime ideal.

There is an obvious notion of the product of two ideals:

𝔞𝔟|c ⟺ c = ∑ a_{i}b_{i}, 𝔞|a_{i}, 𝔟|b_{i}.

In other words,

𝔞𝔟 = {∑ a_{i}b_{i} | a_{i} ∈ 𝔞, b_{i} ∈ 𝔟}.

One see easily that this is again an ideal, and that if

𝔞 = (a_{1}, ..., a_{m}) and 𝔟 = (b_{1}, ..., b_{n})

then

𝔞 · 𝔟 = (a_{1}b_{1}, a_{1}b_{2}, ..., a_{i}b_{j}, ..., a_{m}b_{n}).

With these definitions, one recovers unique factorization: if a ≠ 0, then there is an essentially unique factorization:

(a) = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{n}^{r_{n}} with each 𝔭_{i} a prime ideal.

In the above example,

(6) = (2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5})(3, 1 + \sqrt{−5})(3, 1 − \sqrt{−5}).

In fact, I claim

\begin{aligned}(2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5}) & = (2) \\ (3, 1 + \sqrt{−5})(3, 1 − \sqrt{−5}) & = (3) \\ (2, 1 + \sqrt{−5})(3, 1 + \sqrt{−5}) & = (1 + \sqrt{−5}) \\ (2, 1 − \sqrt{−5})(3, 1 − \sqrt{−5}) & = (1 − \sqrt{−5}). \end{aligned}

For example, (2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5}) = (4, 2 + 2\sqrt{−5}, 2 − 2\sqrt{−5}, 6). Since every generator is divisible by 2, (2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5}) ⊂ (2). Conversely,

2 = 6 − 4 ∈ (4, 2 + 2\sqrt{−5}, 2 − 2\sqrt{−5}, 6)

and so (2, 1 + \sqrt{−5})(2, 1 − \sqrt{−5}) = (2). Moreover, the four ideals (2, 1 + \sqrt{−5}), (2, 1 − \sqrt{−5}), (3, 1 + \sqrt{−5}), and (3, 1 − \sqrt{−5}) are all prime. For example

ℤ[\sqrt{−5}]/(3, 1 − \sqrt{−5}) = ℤ/(3),

which is an integral domain, and so (3, 1 − \sqrt{−5}) is a prime ideal.

How far is this from what we want, namely, unique factorization of elements? In other words, how many “ideal” elements have we had to add to our “real” elements to get unique factorization. In a certain sense, only a finite number: we shall see that there is a finite set of ideals 𝔞_{1}, ..., 𝔞_{h} such that every ideal is of the form 𝔞_{i} ·(a) for some a. Better, we shall construct a group I of “fractional” ideals in which the principal fractional ideals (a), a ∈ K^{×}, form a subgroup P of finite index. The index is called the class number h_{K} of K. We shall see that

h_{K} = 1 ⟺ O_{K} is a principal ideal domain ⟺ O_{K} is a unique factorization domain.

Units. Unlike ℤ^{×}, O_{K}^{×} can be infinite. For example, (1 + \sqrt{2}) is a unit of infinite order in ℤ[\sqrt{2}] :

(1 + \sqrt{2})(−1 + \sqrt{2}) = 1; (1 + \sqrt{2})^{m} ≠ 1 for m ≥ 1.

In fact ℤ[\sqrt{2}]^{×} = \{±(1 + \sqrt{2})^{m} | m ∈ ℤ\}, and so

ℤ[\sqrt{2}]^{×} ≈ \{±1\} × \{free abelian group of rank 1\}.

In general, we shall show (unit theorem) that the roots of 1 in K form a finite group μ(K), and that

O_{K}^{×} ≈ μ(K) × ℤ^{r} (as an abelian group);

moreover, we shall find r.

Applications. I hope to give some applications. One motivation for the development of algebraic number theory was the attempt to prove Fermat’s last “theorem”, i.e., that there are no integer solutions to the equation

X^{m} + Y^{m} = Z^{m}

when m ≥ 3, except for the obvious solutions.

When m = 3, this can proved by the method of “infinite descent”, i.e., one assumes that one has a solution, and then constructs a smaller solution, which will eventually lead to a contradiction^{1}. The proof makes use of the factorization

Y^{3} = Z^{3} − X^{3} = (Z − X)(Z^{2} + XZ + X^{2}),

1The simplest proof by infinite descent is that showing that \sqrt{2} is irrational.

and it was recognized that a stumbling block to proving the theorem for larger m is that no such factorization exists into polynomials with integer coefficients. This led people to look at more general factorizations.

In a very famous incident, the French mathematician Lamé gave a talk at the Paris Academy in 1847 in which he claimed to prove Fermat’s last theorem using the following ideas. Let p > 2 be a prime, and suppose x, y, z are nonzero integers such that

x^{p} + y^{p} = z^{p}.

Write

x^{p} = z^{p} − y^{p} = ∏(z − ζ^{i}y), 0 ≤ i ≤ d − 1, ζ = e^{2πi/p}.

He then showed how to obtain a smaller solution to the equation, and hence a contradiction. Liouville immediately questioned a step in Lamé’s proof in which he assumed that, in order to show that each factor (z − ζ^{i}y) is a p^{th} power, it suffices to show the factors are relatively prime in pairs and their product is a p^{th} power. In fact, Lamé couldn’t justify his step (ℤ[ζ] is not always a principal ideal domain), and Fermat’s last theorem remains unproven to the present day. However, shortly after Lamé’s embarassing lecture, Kummer used his results on the arithmetic of the fields ℚ[ζ] to prove Fermat’s last theorem for all “regular primes”.

Another application is to finding Galois groups. The splitting field of a polynomial f(X) ∈ ℚ[X] is a Galois extension of ℚ. In Math 594, we learn how to compute the Galois group only when the degree is very small (e.g., ≤ 3). By using algebraic number theory one can write down an algorithm to do it for any degree.

A brief history of numbers

Prehistory ??–1600 Basic arithmetic was developed in many parts of the world thousands of years ago. For example, 3,500 years ago the Babylonians apparently knew how to construct the solutions to

X^{2} + Y^{2} = Z^{2}.

At least they knew that

(4961)^{2} + (6480)^{2} = (8161)^{2}

which could scarcely be found by trial and error. The Chinese remainder theorem was known in China, thousands of years ago. The Greeks knew the fundamental theorem of arithmetic, and, of course, Euclid’s algorithm.

Fermat (1601–1665). Apart from his famous last “theorem”, he invented the method of infinite descent. He also posed the problem of finding integer solutions to the equation,

X^{2} − AY^{2} = 1, A ∈ ℤ,  (*)

which is essentially the problem of finding the units in ℤ[\sqrt{A}]. The English mathematicians found an algorithm for solving the problem, but neglected to show that the algorithm always works.

Euler (1707–1783). Among many other works, he discovered the quadratic reciprocity

law. Lagrange (1736–1813). He proved that the algorithm for solving (*) always leads to

a solution. Legendre (1752–1833). He proved the “Hasse principle” for quadratic forms in three

variables over ℚ: the quadratic form Q(X, Y, Z) has a nontrivial zero in ℚ if and only if it has one in ℝ and the congruence Q ≡ 0 mod p^{n} has a nontrivial solution for all p and n.

Gauss (1777–1855). He found many proofs of the quadratic reciprocity law:

(\frac{p}{q}) (\frac{q}{p}) = (−1)^{(p−1)(q−1)/4}, p, q odd primes.

He studied the Gaussian integers ℤ[i] in order to find a quartic reciprocity law. He studied the classification of binary quadratic forms over ℤ which, as we shall see, is closely related to the problem of finding the class numbers of quadratic fields.

Dirichlet (1805–1859). He proved the following “unit theorem”: let α be a root of a monic irreducible polynomial f(X) with integer coefficients; suppose that f(X) has r real roots and 2s complex roots; then ℤ[α]^{×} is a finitely generated group of rank r + s − 1. He proved a famous analytic formula for the class number.

Kummer (1810–1893). He made a deep study of the arithmetic of cyclotomic fields, motivated by a search for higher reciprocity laws. His general result on Fermat’s last theorem is the most important to date.

Hermite (1822–1901). Eisenstein (1823–1852). Kronecker (1823–1891). He developed an alternative to Dedekind’s ideals. He

also had one of the most beautiful ideas in mathematics, the Kronecker liebster Jugendtraum, for generating abelian extensions of number fields.

Riemann (1826–1866). Made the Riemann hypothesis. Dedekind (1831–1916). He was the first mathematician to formally define fields—

many of the basic theorems on fields in Math 594 were proved by him. He also found the correct general definition of the ring of integers in a number field, and he proved that prime ideals factor uniquely into products of prime ideals. Moreover, he improved the Dirichlet unit theorem.

Weber (1842–1913). Made important progress in class field theory and the Kronecker

Jugendtraum. Hensel (1861–1913). He introduced the notion of the p-adic completion of a field. Hilbert (1862–1943). He wrote a very influential book on algebraic number theory

in 1897, which gave the first systematic account of the theory. Some of his famous problems were on number theory, and have also been influential.

Takagi (1875–1960). He made very important advances in class field theory. Hecke (1887–1947). Introduced Hecke L-series.

Artin (1898–1962). He found the “Artin reciprocity law”, which is the main theorem

of class field theory. Hasse (1898–??). Proved the Hasse principle for all quadratic forms over number

fields. Chevalley (1909–??). The main statements of class field theory are purely algebraic,

but all the earlier proofs used analysis. Chevalley gave a purely algebraic proof. Tate (1925– ). With Artin, he gave a complete cohomological treatment of class field

theory. With Lubin he introduced a concrete way of generating abelian extensions of local fields.

Langlands (1936– ). “Langlands’s philosophy” is a vast series of conjectures that, among other things, contains a nonabelian class field theory.

BOOKS

Artin, E., and Tate, J: Class Field Theory. This is the original account of the coho-

mological approach to class field theory. Artin, E: Theory of Algebraic Numbers. Elegant; good examples; but he adopts a

valuation approach rather than the ideal-theoretic approach we use in this course. Artin, E: Algebraic Numbers and Algebraic Functions. Covers both the number field

and function field case. Cassels and Fröhlich: Algebraic Number Theory (Brighton Conference). This is the

best place to learn the cohomological approach to class field theory (articles of Serre and Tate), but students find it a bit concise.

Cassels: Local fields. Concentrates on local fields, but does also deal with number

fields, and it gives some interesting applications. Cohn, P.M., Algebraic Numbers and Algebraic Functions. The valuation approach. Edwards: Fermat’s Last Theorem: A Genetic Introduction to Algebraic Number The-

ory. A history of algebraic number theory, concentrating on the efforts to prove Fermat’s last theorem. Edwards is one of the few reliable writers on the history of number theory.

Fröhlich and Taylor: Algebraic Number Theory. Lots of good problems. Goldstein: Analytic Number Theory. Similar to Lang’s book (see below), but even

more carelessly written; sometimes includes more details than Lang, and so is probably easier to read.

Iwasawa: The best modern account of local class field theory. Janusz*: Algebraic Number Fields. It covers both algebraic number theory and class

field theory, which it treats from a lowbrow analytic/algebraic approach. In the past, I’ve sometimes used this as a text for 676/776, but it’s a bit dull.

Lang, S . Algebraic Numbers. Difficult to read unless you already know it, but it does cover an enormous amount of material. Covers algebraic number theory, and it does class field theory from a highbrow analytic/algebraic approach.

Marcus, D. Number Fields. This is a rather pleasant down-to-earth treatment of

algebraic number theory. Narkiewicz, W. Algebraic Numbers. Encyclopedic coverage of algebraic number the-

ory. Neukirch: Class field theory. The shortest account of class field theory. Unfortunately,

he seemed more intent on setting a world record for brevity than in giving a readable account.

Samuel: A very easy treatment, with lots of good examples, but doesn’t go very far. Serre: Corps Locaux (Tr. Local Fields). A classic. An excellent account of local fields,

cohomology of groups, and local class field theory. The local class field theory is bit dated (Lubin-Tate groups weren’t known when the book was written) but this is the best book for the other two topics.

Weil: Basic Number Theory. Very heavy going, but you will learn a lot if you manage

to read it (covers algebraic number theory and class field theory). Weiss: Algebraic Number Theory. Very detailed; in fact a bit too fussy and pedantic. Weyl: Algebraic Theory of Numbers (1940). One of the first books in English; by one

of the great mathematicians of the twentieth century. Idiosyncratic—Weyl prefers Kronecker to Dedekind, e.g., see the section “Our disbelief in ideals”.

§1 Preliminaries From Commutative Algebra

Many results that were first proved for rings of integers in number fields are true for more general commutative rings, and it is more natural to prove them in that context.

Basic definitions. All rings will be commutative, and have an identity element (i.e., an element 1 such that 1a = a for all a ∈ A), and a homomorphism of rings will map the identity element to the identity element.

A ring B together with a homomorphism of rings A → B will be referred to as an A-algebra. We use this terminology mainly when A is a subring of B. In this case, for elements β_{1}, ..., β_{m} of B, A[β_{1}, ..., β_{m}] denotes the smallest subring of B containing A and the β_{i}. It consists of all polynomials in the β_{i} with coefficients in A, i.e., elements of the form

∑ a_{i_{1}...i_{m}}β_{1}^{i_{1}}...β_{m}^{i_{m}}, a_{i_{1}...i_{m}} ∈ A.

We also refer to A[β_{1}, ..., β_{m}] as the A-subalgebra of B generated by the β_{i}, and when B = A[β_{1}, ..., β_{m}] we say that the β_{i} generate B as an A-algebra.

For elements a_{1}, a_{2}, … of A, (a_{1}, a_{2}, …) denotes the smallest ideal containing the a_{i}. It consists of finite sums ∑ c_{i}a_{i}, c_{i} ∈ A, and it is called the ideal generated by a_{1}, a_{2}, . . .. When 𝔞 and 𝔟 are ideals in A, we define

𝔞 + 𝔟 = {a + b | a ∈ 𝔞, b ∈ 𝔟}.

It is again an ideal in A; in fact, it is the smallest ideal containing both 𝔞 and 𝔟. If 𝔞 = (a_{1}, ..., a_{m}) and 𝔟 = (b_{1}, ..., b_{n}), then 𝔞 + 𝔟 = (a_{1}, ..., a_{m}, b_{1}, ..., b_{n}).

Given an ideal 𝔞 in A, we can form the quotient ring A/𝔞. Let f: A → A/𝔞 be the homomorphism a ↦ a + 𝔞; then 𝔟 ↦ f^{−1}(𝔟) defines a one-to-one correspondence between the ideals of A/𝔞 and the ideals of A containing 𝔞, and A/f^{−1}(𝔟) ⟶^{≈} (A/𝔞)/𝔟.

A proper ideal 𝔞 of A is prime if ab ∈ 𝔞 ⇒ a or b ∈ 𝔞. An ideal 𝔞 is prime if and only if the quotient ring A/𝔞 is an integral domain. An element p of A is said to be prime if (p) is a prime ideal; equivalently, if p|ab ⟹ p|a or p|b.

A proper ideal 𝔞 in A is maximal if there does not exist an ideal 𝔟, 𝔞 ⫋ 𝔟 ⫋ A. An ideal 𝔞 is maximal if and only if A/𝔞 is a field. Every proper ideal 𝔞 of A is contained in a maximal ideal—if A is Noetherian (see below) this is obvious; otherwise the proof requires Zorn’s lemma. In particular, every nonunit in A is contained in a maximal ideal.

There are the implications: A is a Euclidean domain ⟹ A is a principal ideal domain ⟹ A is a unique factorization domain (see Math 593).

Noetherian rings.

Lemma 1.1. The following conditions on a ring A are equivalent:

(a) Every ideal in A is finitely generated.

(b) Every ascending chain of ideals

𝔞_{1} ⊂ 𝔞_{2} ⊂ ... ⊂ 𝔞_{n} ⊂ ...

becomes stationary, i.e., after a certain point 𝔞_{n} = 𝔞_{n+1} = · · ·.

(c) every nonempty set S of ideals in A has a maximal element 𝔞, i.e., such that 𝔞 is not properly contained in any ideal in S.

Proof. (a) ⟹ (b): Let 𝔞 = ∪𝔞_{i}; it is an ideal, and hence is finitely generated, say 𝔞 = (a_{1}, …, a_{r}). For some n, 𝔞_{n} will contain all the a_{i}, and so 𝔞_{n} = 𝔞_{n+1} = ⋯ = 𝔞.

(b) ⟹ (a): Consider an ideal 𝔞. If 𝔞 = (0), then 𝔞 is generated by the empty set, which is finite. Otherwise there is an element a_{1} ∈ 𝔞, a_{1} ≠ 0. If 𝔞 = (a_{1}), then 𝔞 is certainly finitely generated. If not, there is an element a_{2} ∈ 𝔞 such that (a_{1}) ⫋ (a_{1}, a_{2}). Continuing in this way, we obtain a chain of ideals

(a_{1}) ⫋ (a_{1}, a_{2}) ⫋ · · · .

This process must eventually stop with (a_{1}, …, a_{n}) = 𝔞.

(b) ⟹ (c): Let 𝔞_{1} ∈ S. If 𝔞_{1} is not a maximal element of S, then there is an 𝔞_{2} ∈ S such that 𝔞_{1} ⫋ 𝔞_{2}. If 𝔞_{2} is not maximal, then there is an 𝔞_{3} etc.. From (b) we know that this process will lead to a maximal element after only finitely many steps.

(c) ⟹ (b): Apply (c) to the set S = {𝔞_{i}}. □

A ring A satisfying the equivalent conditions of the lemma is said to Noetherian^{2} A famous theorem of Hilbert states that k[X_{1}, ..., X_{n}] is Noetherian. In prac-

tice, almost all the rings that arise naturally in algebraic number theory or algebraic geometry are Noetherian, but not all rings are Noetherian. For example, k[X_{1}, …, X_{n}, …] is not Noetherian: X_{1}, …, X_{n} is a minimal set of generators for the ideal (X_{1}, …, X_{n}) in k[X_{1}, …, X_{n}], and X_{1}, …, X_{n}, … is a minimal set of generators for the ideal (X_{1}, …, X_{n}, …) in k[X_{1}, …, X_{n}, …]

Proposition 1.2. Every nonzero nonunit element of a Noetherian integral domain can be written as a product of irreducible elements.

Proof. We shall need to use that

(a) ⊂ (b) ⟺ b|a, with equality ⟺ b = a × unit.

The first assertion is obvious. For the second, note that if a = bc and b = ad then a = bc = adc, and so dc = 1. Hence both c and d are units.

Suppose the statement is false, and choose an element a ∈ A which contradicts the statement and is such that (a) is maximal among the ideals generated by such elements (here we use that A is Noetherian). Since a can not be written as a product of irreducible elements, it is not itself irreducible, and so a = bc with b and c nonunits. Clearly (b) ⊃ (a), and the ideals can’t be equal for otherwise c would be a unit. From the maximality of (a), we deduce that b can be written as a product of irreducible elements, and similarly for c. Thus a is a product of irreducible elements, and we have a contradiction.

2After Emmy Noether (1882–1935).

Local rings. A ring A is said to local if it has exactly one maximal ideal 𝔪. In this case, A^{×} = A − 𝔪.

Lemma 1.3. (Nakayama’s lemma) Let A be a local Noetherian ring, and let 𝔞 be an ideal in A, 𝔞 ≠ A. Let M be a finitely generated A-module, and define

𝔞M = {∑ a_{i}m_{i} | a_{i} ∈ 𝔞, m_{i} ∈ M}.

(a) If 𝔞M = M, then M = 0.

(b) If N is a submodule of M such that N + 𝔞M = M, then N = M.

Proof. (a) Suppose M ≠ 0. Among the finite sets of generators for M, choose one {m_{1}, ..., m_{k}} having the fewest elements. From the hypothesis, we know that we can write

m_{k} = a_{1}m_{1} + a_{2}m_{2} + ...a_{k}m_{k} some a_{i} ∈ 𝔞.

Then

(1 − a_{k})m_{k} = a_{1}m_{1} + a_{2}m_{2} + ... + a_{k−1}m_{k−1}.

As 1 − a_{k} is not in 𝔪, it is a unit, and so {m_{1}, ..., m_{k−1}} generates M. This contradicts our choice of {m_{1}, ..., m_{k}}, and so M = 0.

(b) We shall show that 𝔞(M/N) = M/N, and then apply the first part of the lemma to deduce that M/N = 0. Consider m + N, m ∈ M. From the assumption, we can write

m = n + ∑ a_{i}m_{i}, with a_{i} ∈ 𝔞, m_{i} ∈ M.

Whence

m + N = ∑ a_{i}m_{i} + N = ∑ a_{i}(m_{i} + N) (definition of the action of A on M/N),

and so m + N ∈ 𝔞(M/N). □

Rings of fractions. Let A be an integral domain; there is a field K ⊃ A, called the field of fractions of A, with the property that every c ∈ K can be written in the form c = ab^{−1}, a, b ∈ A, b ≠ 0. For example, ℚ is the field of fractions of ℤ, and k(X) is the field of fractions of k[X].

Let A be an integral domain with field of fractions K. A subset S of A is said to be multiplicative if 0 ∉ S, 1 ∈ S, and S is closed under multiplication. If S is a multiplicative subset, then we define

S^{−1}A = {a/b ∈ K | b ∈ S}.

It is obviously a subring of K.

Example 1.4. (a) Let t be a nonzero element of A; then

S_{t} =_{df} {1,t,t^{2},...}

is a multiplicative subset of A, and we (sometimes) write A_{t} for S_{t}^{−1}A. For example, if d is a nonzero integer,

ℤ_{d} = {a/d^{n} ∈ ℚ | a ∈ ℤ, n ≥ 0}.

(b) If 𝔭 is a prime ideal, then S_{𝔭} = A − 𝔭 is a multiplicative set (if neither a nor b belongs to 𝔭, then ab does not belong to 𝔭). We write A_{𝔭} for S_{𝔭}^{−1}A. For example,

ℤ_{(p)} = {m/n ∈ ℚ | n is not divisible by p}.

Proposition 1.5. Let A be an integral domain, and let S be a multiplicative subset of A. The map

𝔭 ↦ S^{−1}𝔭 =_{df} {a/s | a ∈ 𝔭, s ∈ S}

is a bijection from the set of prime ideals in A such that 𝔭 ∩ S = ∅ to the set of prime ideals in S^{−1}A; the inverse map is 𝔮 ↦ 𝔮 ∩ A.

Proof. It is easy to see that

𝔭 a prime ideal disjoint from S ⟹ S^{−1}𝔭 is a prime ideal,

𝔮 a prime ideal in S^{−1}A ⟹ 𝔮 ∩ A is a prime ideal disjoint from S,

and so we only have to show that the two maps are inverse, i.e.,

(S^{−1}𝔭) ∩ A = 𝔭 and S^{−1}(𝔮 ∩ A) = 𝔮.

(S^{−1}𝔭) ∩ A = 𝔭 : Clearly (S^{−1}𝔭) ∩ A ⊃ 𝔭. For the reverse inclusion, let a/s ∈ (S^{−1}𝔭) ∩ A, a ∈ 𝔭, s ∈ S. Consider the equation \frac{a}{s} · s = a ∈ 𝔭. Both a/s and s are in A, and so at least one of a/s or s is in 𝔭 (because it is prime); but s ∉ 𝔭 (by assumption), and so a/s ∈ 𝔭.

S^{−1}(𝔮 ∩ A) = 𝔮 : Clearly S^{−1}(𝔮 ∩ A) ⊂ 𝔮 because 𝔮 ∩ A ⊂ 𝔮 and 𝔮 is an ideal in S^{−1}A. For the reverse inclusion, let b ∈ 𝔮. We can write it b = a/s with a ∈ A, s ∈ S. Then a = s · (a/s) ∈ 𝔮 ∩ A, and so a/s ∈ S^{−1}(𝔮 ∩ A). □

Example 1.6. (a) If 𝔭 is a prime ideal in A, then A_{𝔭} is a local ring (because 𝔭 contains every (prime) ideal disjoint from S_{𝔭}).

(b) We list the prime ideals in some rings:

ℤ: (2), (3), (5), (7), (11), …, (0);

ℤ_{2}: (3), (5), (7), (11), …, (0);

ℤ_{(2)}: (2), (0);

ℤ_{42}: (5), (11), (13), …, (0);

ℤ/(42): (2), (3), (7).

Note that in general, for t a nonzero element of an integral domain,

{prime ideals of A_{t}} ↔ {prime ideals of A not containing t}

{prime ideals of A/(t)} ↔ {prime ideals of A containing t}.

The Chinese remainder theorem. Recall the classical form of the theorem: let d_{1}, ..., d_{n} be integers, relatively prime in pairs; then for any integers x_{1}, ..., x_{n}, the equations

x ≡ x_{i} (mod d_{i})

have a simultaneous solution x ∈ ℤ; if x is one solution, then the other solutions are the integers of the form x + md, m ∈ ℤ, where d = ∏ d_{i}.

We want to translate this in terms of ideals. Integers m and n are relatively prime if and only if (m, n) = ℤ, i.e., if and only if (m) + (n) = ℤ. This suggests defining ideals 𝔞 and 𝔟 in a ring A to be relatively prime if 𝔞 + 𝔟 = A.

If m_{1}, ..., m_{k} are integers, then ∩(m_{i}) = (m) where m is the least common multiple of the m_{i}. Thus ∩(m_{i}) ⊃ (∏ m_{i}) = ∏(m_{i}). If the m_{i} are relatively prime in pairs, then m = ∏ m_{i}, and so we have ∩(m_{i}) = ∏(m_{i}). Note that in general,

𝔞_{1} · 𝔞_{2} ⋯ 𝔞_{n} ⊂ 𝔞_{1} ∩ 𝔞_{2} ∩ ... ∩ 𝔞_{n}.

These remarks suggest the following statement.

Theorem 1.7. Let 𝔞_{1}, ..., 𝔞_{n} be ideals in a ring A, relatively prime in pairs. Then for any elements x_{1}, ..., x_{n} of A, the equations

x ≡ x_{i} (mod 𝔞_{i})

have a simultaneous solution x ∈ A; if x is one solution, then the other solutions are of the form x + a with a ∈ ∩𝔞_{i}; moreover, ∩𝔞_{i} = ∏ 𝔞_{i}. In other words, there is an exact sequence:

0 ⟶ 𝔞 ⟶ A ⟶ ∏ A/𝔞_{i} ⟶ 0

with 𝔞 = ∩𝔞_{i} = ∏ 𝔞_{i}.

Proof. Suppose first that n = 2. As 𝔞_{1} + 𝔞_{2} = A, there are elements a_{i} ∈ 𝔞_{i} such that a_{1} + a_{2} = 1. The element x =_{df} a_{1}x_{2} + a_{2}x_{1} has the required property.

For each i we can find elements a_{i} ∈ 𝔞_{1} and b_{i} ∈ 𝔞_{i} such that

a_{i} + b_{i} = 1, all i ≥ 2.

The product ∏_{i≥2}(a_{i} + b_{i}) = 1, and lies in 𝔞_{1} + ∏_{i≥2} 𝔞_{i}, and so

𝔞_{1} + ∏_{i≥2} 𝔞_{i} = A.

We can now apply the theorem in the case n = 2 to obtain an element y_{1} ∈ A such that

y_{1} ≡ 1 mod 𝔞_{1}, y_{1} ≡ 0 mod ∏_{i≥2} 𝔞_{i}.

These conditions imply

y_{1} ≡ 1 mod 𝔞_{1}, y_{1} ≡ 0 mod 𝔞_{j}, all j > 1.

Similarly, there exist elements y_{2}, ..., y_{n} such that

y_{i} ≡ 1 mod 𝔞_{i}, y_{i} ≡ 0 mod 𝔞_{j} for j ≠ i.

The element x = ∑ x_{i}y_{i} now satisfies the requirements.

It remains to prove that ∩𝔞_{i} = ∏ 𝔞_{i}. We have already noted that ∩𝔞_{i} ⊃ ∏ 𝔞_{i}. First suppose that n = 2, and let a_{1} + a_{2} = 1, as before. For c ∈ 𝔞_{1} ∩ 𝔞_{2}, we have

c = a_{1}c + a_{2}c ∈ 𝔞_{1} · 𝔞_{2}.

We complete the proof by induction. This allows us to assume that ∏_{i≥2} 𝔞_{i} = ∩_{i≥2}𝔞_{i}. We showed above that 𝔞_{1} and ∏_{i≥2} 𝔞_{i} are relatively prime, and so

𝔞_{1} · (∏_{i≥2} 𝔞_{i}) = 𝔞_{1} ∩ (∏_{i≥2} 𝔞_{i}) = ∩𝔞_{i}. □

The theorem extends to A-modules.

Theorem 1.8. Let 𝔞_{1}, ..., 𝔞_{n} be ideals in A, relatively prime in pairs, and let M be an A-module. There is an exact sequence:

0 ⟶ 𝔞M ⟶ M ⟶ ∏_{i} M/𝔞_{i}M ⟶ 0

with 𝔞 = ∏ 𝔞_{i} = ∩𝔞_{i}.

This has an elementary proof (see Janusz p9), but I prefer to use tensor products, which I now review.

Review of tensor products. Let M, N, and P be A-modules. A mapping f: M × N → P is said to be A-bilinear if

f(m + m′, n) = f(m, n) + f(m′, n); f(m, n + n′) = f(m, n) + f(m, n′)

f(am, n) = af(m, n) = f(m, an), a ∈ A, m, m′ ∈ M, n, n′ ∈ N,

i.e., if it is linear in each variable. A pair (Q, f) consisting of an A-module Q and an A-bilinear map f: M × N → Q is called the tensor product of M and N if any other A-bilinear map f′: M × N → P factors uniquely into f′ = α ∘ f with α: Q → P A-linear. The tensor product exists, and is unique (up to a unique isomorphism). We denote it by M ⊗_{A} N, and we write (m, n) ↦ m ⊗ n for f. The pair (M ⊗_{A} N, (m, n) ↦ m ⊗ n) is characterized by each of the following two conditions:

(a) The map M × N ⟶ M ⊗_{A} N is A-bilinear, and any other A-bilinear map M × N ⟶ P is of the form (m, n) ↦ α(m ⊗ n) for a unique A-linear map α: M ⊗_{A} N → P; thus

Bilin_{A}(M × N, P) = Hom_{A}(M ⊗_{A} N, P).

(b) As an A-module, M ⊗_{A} N has generators the symbols m⊗n, m ∈ M, n ∈ N, and relations

(m + m′) ⊗ n = m ⊗ n + m′ ⊗ n; m ⊗ (n + n′) = m ⊗ n + m ⊗ n′
am ⊗ n = a(m ⊗ n) = m ⊗ an.

Tensor products commute with direct sums: there is a canonical isomorphism

(⊕_{i}M_{i}) ⊗_{A} (⊕_{j}N_{j}) ⟶^{≈} ⊕_{i,j}M_{i} ⊗_{A} N_{j}, (∑ m_{i}) ⊗ (∑ n_{j}) ↦ ∑ m_{i} ⊗ n_{j}.

It follows that if M and N are free A-modules^{3} with bases (e_{i}) and (f_{j}) respectively, then M ⊗_{A} N is a free A-module with basis (e_{i} ⊗ f_{j}). In particular, if V and W are vector spaces over a field k of dimensions m and n respectively, then V ⊗_{k} W is a vector space over k of dimension mn.

Let α: M → N and β: M′ → N′ be A-linear maps. Then

M × N ⟶ M′ ⊗_{A} N′, (m, n) ↦ α(m) ⊗ β(n)

is A-bilinear, and therefore factors through M × N → M ⊗_{A} N. Thus there is an A-linear map α ⊗ β: M ⊗_{A} N → M′ ⊗_{A} N′ such that

(α ⊗ β)(m ⊗ n) = α(m) ⊗ β(n).

Remark 1.9. Let α: k^{m} → k^{m} and β: k^{n} → k^{n} be two matrices, regarded as a linear maps. Then α ⊗ β is a linear map k^{mn} → k^{mn}. Its matrix with respect to the canonical basis is called the Kronecker product of the two matrices. (Kronecker products of matrices pre-date tensor products by about 70 years.)

Lemma 1.10. If α: M → N and β: M′ → N′ are surjective, then so also is

α ⊗ β: M ⊗_{A} N → M′ ⊗_{A} N′.

Proof. Recall that M′ ⊗ N′ is generated as an A-module by the elements m′ ⊗ n′, m′ ∈ M′, n′ ∈ N. By assumption m′ = α(m) for some m ∈ M and n′ = β(n) for some n ∈ N, and so m′ ⊗ n′ = α(m) ⊗ β(n) = (α ⊗ β)(m ⊗ n). Therefore Im(α ⊗ β) contains a set of generators for M′ ⊗_{A} N′ and so it is equal to it. □

3Let M be an A-module. Elements e_{1}, …, e_{m} form a basis for M if every element of M can be expressed uniquely as a linear combination of the e_{i}’s with coefficients in A. Then A^{m} → M, (a_{1}, …, a_{m}) ↦ ∑ a_{i}e_{i}, is an isomorphism of A-modules, and M is said to be a free A-module of rank m.

One can also show that

M′ ⟶ M ⟶ M′′ ⟶ 0 exact ⟹ M′ ⊗_{A} P ⟶ M ⊗_{A} P ⟶ M′′ ⊗_{A} P ⟶ 0 exact.

For example, if we tensor the exact sequence

0 ⟶ 𝔞 ⟶ A ⟶ A/𝔞 ⟶ 0

with M, we obtain an exact sequence

𝔞 ⊗ M ⟶ M ⟶ (A/𝔞) ⊗_{A} M ⟶ 0.

The image of 𝔞 ⊗ M in M is

𝔞M =_{df} {∑ a_{i}m_{i} | a_{i} ∈ 𝔞, m_{i} ∈ M},

and so we obtain from the exact sequence that

M/𝔞M = (A/𝔞) ⊗_{A} M.  (1.11)

By way of contrast, if M → N is injective, then M ⊗_{A} P → N ⊗_{A} P need not be injective. For example, take A = ℤ, and note that

(ℤ ⟶^{m} ℤ) ⊗_{ℤ} (ℤ/mℤ) = ℤ/mℤ ⟶^{m=0} ℤ/mℤ.

Proof of Theorem 1.8. Return to the situation of the theorem. When we tensor the isomorphism

A/𝔞 ⟶^{≈} ∏ A/𝔞_{i}

with M, we get an isomorphism

M/𝔞M = (A/𝔞) ⊗_{A} M ⟶^{≈} ∏(A/𝔞_{i}) ⊗_{A} M = ∏ M/𝔞_{i}M,

as required.

Extension of scalars. If A → B is an A-algebra and M is an A-module, then B ⊗_{A} M has a natural structure of a B-module for which

b(b′ ⊗ m) = bb′ ⊗ m, b, b′ ∈ B, m ∈ M.

We say that B ⊗_{A} M is the B-module obtained from M by extension of scalars. The map m ↦ 1 ⊗ m: M → B ⊗_{A} M is uniquely determined by the following universal property: it is A-linear, and for any A-linear map α: M → N from M into a B-module N, there is a unique B-linear map α′: B ⊗_{A} M → N such that α′(1 ⊗ m) = α(m). Thus α ↦ α′ defines an isomorphism

Hom_{A}(M, N) ⟶ Hom_{B}(B ⊗_{A} M, N), (N a B-module).

For example, A ⊗_{A} M = M. If M is a free A-module with basis e_{1}, …, e_{m}, then B ⊗_{A} M is a free B-module with basis 1 ⊗ e_{1}, …, 1 ⊗ e_{m}.

Tensor products of algebras. If f: A → B and g: A → C are A-algebras, then B⊗_{A}C has a natural structure of an A-algebra: the product structure is determined by the rule

(b ⊗ c)(b′ ⊗ c′) = bb′ ⊗ cc′

and the map A → B ⊗_{A} C is a ↦ f(a) ⊗ 1 = 1 ⊗ g(a).

For example, there is a canonical isomorphism

a ⊗ f ↦ af: K ⊗_{k} k[X_{1}, …, X_{m}] ⟶ K[X_{1}, …, X_{m}].  (1.12)

Tensor products of fields. We are now able to compute K ⊗_{k} Ω if K is a finite separable field extension of k and Ω is an arbitrary field extension of k. According to the primitive element theorem, K = k[α] for some α ∈ K. Let f(X) be the minimum polynomial of α. By definition this means that the map g(X) ↦ g(α) determines an isomorphism

k[X]/(f(X)) ⟶ K.

Hence

K ⊗_{k} Ω ≈ (k[X]/(f(X))) ⊗ Ω = Ω[X]/(f(X))

by (1.11) and (1.12). Because K is separable over k, f(X) has distinct roots. Therefore f(X) factors into monic irreducible polynomials

f(X) = f_{1}(X) ⋯ f_{r}(X)

in Ω[X] that are relatively prime in pairs. We can apply the Chinese remainder theorem to deduce that

Ω[X]/(f(X)) = ∏_{i=1}^{r} Ω[X]/(f_{i}(X)).

Finally, Ω[X]/(f_{i}(X)) is a finite separable field extension of Ω of degree deg f_{i}. Thus we have proved the following result:

Theorem 1.13. Let K be a finite separable field extension of k, and let Ω be an arbitrary field extension. Then K ⊗_{k} Ω is a product of finite separable field extensions of Ω,

K ⊗_{k} Ω = ∏_{i=1}^{r} Ω_{i}.

If α is a primitive element for K/k, then the image α_{i} of α in Ω_{i} is a primitive element for Ω_{i}/Ω, and if f(X) and f_{i}(X) are the minimum polynomials for α and α_{i} respectively, then

f(X) = ∏_{i=1}^{r} f_{i}(X).

PRELIMINARIES FROM COMMUTATIVE ALGEBRA 19

Example 1.14. Let K = ℚ[α], α algebraic over ℚ. Then

ℂ ⊗_{ℚ} K = ℂ ⊗_{ℚ} (ℚ[X]/(f(X))) = ℂ[X]/((f(X)) = ∏ ℂ[X]/(X − α_{i}) ≈ ℂ^{r}. Here α_{1}, …, α_{r} are the conjugates of α in ℂ.

Finally we note that it is essential to assume in (1.13) that K is separable over k. If not, there will be an α ∈ K, α^{p} = a ∈ k, α ∉ k. The ring K ⊗_{k} K contains an element β = (α ⊗ 1 − 1 ⊗ α) ≠ 0 such that

β^{p} = a ⊗ 1 − 1 ⊗ a = a(1 ⊗ 1) − a(1 ⊗ 1) = 0.

Hence K ⊗_{k} K contains a nonzero nilpotent element, and so can’t be a product of fields.

§2 Rings of Integers

Let A be an integral domain, and let L be a field containing A. An element α of L is said to be integral over A if it is a root of a monic polynomial with coefficients in A, i.e., if it satisfies an equation

α^{n} + a_{1}α^{n−1} + ... + a_{n} = 0, a_{i} ∈ A.

Before proving that the elements of L integral over A form a ring, we need to review symmetric polynomials.

Symmetric polynomials. A polynomial P (X_{1}, ..., X_{r}) ∈ A[X_{1}, …, X_{r}] is said to be symmetric if it is unchanged when its variables are permuted, i.e., if

P (X_{σ(1)}, …, X_{σ(r)}) = P (X_{1}, …, X_{r}), all σ ∈ Sym_{r}.

For example

S_{1} = ∑ X_{i}, S_{2} = ∑_{i<j} X_{i}X_{j}, …, S_{r} = X_{1} ⋯ X_{r},

are all symmetric. These particular polynomials are called the elementary symmetric polynomials.

Theorem 2.1. (Symmetric function theorem) Let A be a ring. Every symmetric polynomial P (X_{1}, ..., X_{r}) in A[X_{1}, ..., X_{r}] is equal to a polynomial in the symmetric elementary polynomials with coefficients in A, i.e., P ∈ A[S_{1}, ..., S_{r}].

Proof. We define an ordering on the monomials in the X_{i} by requiring that

X_{1}^{i_{1}}X_{2}^{i_{2}} ⋯ X_{r}^{i_{r}} > X_{1}^{j_{1}}X_{2}^{j_{2}} ⋯ X_{r}^{j_{r}}

if either

i_{1} + i_{2} + ⋯ + i_{r} > j_{1} + j_{2} + ⋯ + j_{r}

or equality holds and, for some s,

i_{1} = j_{1}, …, i_{s} = j_{s}, but i_{s+1} > j_{s+1}.

Let X_{1}^{k_{1}} ⋯ X_{r}^{k_{r}} be the highest monomial occurring in P with a coefficient c ≠ 0. Because P is symmetric, it contains all monomials obtained from X_{1}^{k_{1}} ⋯ X_{r}^{k_{r}} by permuting the Xs. Hence k_{1} ≥ k_{2} ≥ ⋯ ≥ k_{r}.

Clearly, the highest monomial in S_{i} is X_{1} ⋯ X_{i}, and it follows easily that the highest monomial in S_{1}^{d_{1}} ⋯ S_{r}^{d_{r}} is

X_{1}^{d_{1}+d_{2}+···+d_{r}}X_{2}^{d_{2}+···+d_{r}} ⋯ X_{r}^{d_{r}}.

Therefore

P (X_{1}, …, X_{r}) − cS_{1}^{k_{1}−k_{2}}S_{2}^{k_{2}−k_{3}} ⋯ S_{r}^{k_{r}} < P (X_{1}, …, X_{r}).

We can repeat this argument with the polynomial on the left, and after a finite number of steps, we will arrive at a representation of P as a polynomial in S_{1}, …, S_{r}.

For more details, see Jacobson, Basic Algebra I, 2.20, p139. □

Let f(X) = X^{n} + a_{1}X^{n−1} + ⋯ + a_{n} ∈ A[X], and let α_{1}, …, α_{n} be the roots of f(X) in some ring containing A, i.e., f(X) = ∏(X − α_{i}). Then

a_{1} = −S_{1}(α_{1}, …, α_{n}), a_{2} = S_{2}(α_{1}, …, α_{n}), …, a_{n} = ±S_{n}(α_{1}, …, α_{n}).

Thus the elementary symmetric polynomials in the roots of f(X) lie in A, and so the theorem implies that every symmetric polynomial in the roots of f(X) lie in A.

Integral elements.

Theorem 2.2. The set of elements of L integral over A forms a ring.

Proof. I shall give two proofs, first an old-fashioned proof, and later the slick modern proof. Suppose α and β are integral over A; I’ll prove only that α + β is integral over A since the same proof works for α − β and αβ. Let Ω be an algebraically closed field containing L.

We are given that α is a root of a polynomial f(X) = X^{m} + a_{1}X^{m−1} + … + a_{m}, a_{i} ∈ A. Write

f(X) = ∏(X − α_{i}), α_{i} ∈ Ω.

Similarly, β is a root of polynomial g(X) = X^{n} + b_{1}X^{n−1} + ... +b_{n}, b_{i} ∈ A, and we write

f(X) = ∏(X − β_{i}), β_{i} ∈ Ω.

Let γ_{1}, γ_{2}, ..., γ_{mn} be the family of numbers of the form α_{i} +β_{j} (or α_{i} −β_{j}, or α_{i}β_{j}). I claim that h(X) =_{df} ∏(X − γ_{ij}) has coefficients in A. This will prove that α + β is integral over A because h is monic and h(α + β) = 0.

The coefficients of h are symmetric in the α_{i} and β_{j}. Let P (α_{1}, ..., α_{m}, β_{1}, ..., β_{n}) be one of these coefficients, and regard it as a polynomial Q(β_{1}, ..., β_{n}) in the βs with coefficients in A[α_{1}, ..., α_{m}]; then its coefficients are symmetric in the α_{i}, and so lie in A. Thus P (α_{1}, ..., α_{m}, β_{1}, ..., β_{n}) is a symmetric polynomial in the βs with coefficients in A—it therefore lies in A, as claimed. □

Definition 2.3. The ring of elements of L integral over A is called the integral closure of A in L. The integral closure of ℤ in an algebraic number field L is called the ring of integers O_{L} in L.

Next we want to see that L is the field of fractions of O_{L}; in fact we can prove more.

Proposition 2.4. Let K be the field of fractions of A, and let L be a field containing K. If α ∈ L is algebraic over K, then there exists a d ∈ A such that dα is integral over A.

Proof. By assumption, α satisfies an equation

α^{m} + a_{1}α^{m−1} + … + a_{m} = 0, a_{i} ∈ K.

Let d be a common denominator for the a_{i} (this means that da_{i} ∈ A, all i), and multiply through the equation by d^{m} :

d^{m}α^{m} + a_{1}d^{m}α^{m−1} + ... + a_{m}d^{m} = 0.

We can rewrite this as

(dα)^{m} + a_{1}d(dα)^{m−1} + ⋯ + a_{m}d^{m} = 0.

As a_{1}d, ... , a_{m}d^{m} ∈ A, this shows that dα is integral over A. □

Corollary 2.5. Let A be an integral domain with field of fractions K, and let L be an algebraic extension of K. If B is the integral closure of A in L, then L is the field of fractions of B.

Proof. The proposition shows that every α ∈ L can be written α = β/d with β ∈ B, d ∈ A. □

Definition 2.6. A ring A is integrally closed if it is its own integral closure in its field of fractions K, i.e., if

α ∈ K, α integral over A ⟹ α ∈ A.

Proposition 2.7. A unique factorization domain (e.g. a principal ideal domain) is integrally closed.

Proof. Suppose a/b, a, b ∈ A, is an element of the field of fractions of A that is integral over A. If b is a unit, then a/b ∈ A. Otherwise we may suppose that there is an irreducible element p of A dividing b but not a. As a/b is integral over A, it satisifies an equation

(a/b)^{n} + a_{1}(a/b)^{n−1} + … + a_{n} = 0, a_{i} ∈ A.

On multiplying through by b^{n}, we obtain the equation

a^{n} + a_{1}a^{n−1}b + ... + a_{n}b^{n} = 0.

The element p then divides every term on the left except a^{n}, and hence must divide a^{n}. Since it doesn’t divide a, this is a contradiction. □

Hence it is easy to get examples where unique factorization fails—take any ring which is not integrally closed, for example, ℤ[\sqrt{5}].

Example 2.8. (a) The rings ℤ and ℤ[i] are integrally closed.

(b) Let k be a field. I claim that the integral closure of k[S_{1}, ..., S_{m}] in k(X_{1}, …, X_{m}) is k[X_{1}, …, X_{m}].

Let f ∈ k(X_{1}, …, X_{m}) be integral over k[S_{1}, …, S_{m}]. Then f is integral over k[X_{1}, …, X_{m}], which is a unique factorization domain, and hence is integrally closed in its field of fractions. Thus f ∈ k[X_{1}, …, X_{m}].

Conversely, let f ∈ k[X_{1}, …, X_{m}]. Then f is a root of the monic polynomial

∏_{σ∈Sym_{m}}(T − f(X_{σ(1)}, …, X_{σ(m)})).

The coefficients of this polynomial are symmetric polynomials in the X_{i}, and therefore (see 2.1) lie in k[S_{1}, …, S_{r}].

Proposition 2.9. Let K be the field of fractions of A, and let L be an extension of K of finite degree. Assume A is integrally closed. An element α of L is integral over A if and only if its minimum polynomial over K has coefficients in A.

Proof. Assume α is integral over A, so that

α^{m} + a_{1}α^{m−1} + ... + a_{m} = 0, some a_{i} ∈ A.

Let α′ be a conjugate of α, i.e., a root of the minimum polynomial of α over K. Then there is an K-isomorphism

σ: K[α] ⟶ K[α′], σ(α) = α′;

see^{4} Math 594. On applying σ to the above equation we obtain the equation

α′^{m} + a_{1}α′^{m−1} + ... + a_{m} = 0,

which shows that α′ is integral over A. Hence all the conjugates of α are integral over A, and it follows from (2.2) that the coefficients of f(X) are integral over A. They lie in K, and A is integrally closed, and so they lie in A. This proves the “only if” part of the statement, and the “if” part is obvious. □

Remark 2.10. As we noted in the introduction, this makes it easy to compute some rings of integers. For example, an element α ∈ ℚ[\sqrt{d}] is integral over ℤ if and only if its trace and norm lie in ℤ.

4If f(X) is the minimum polynomial of α, hence also of α′, over K, then the map h(X) ↦ h(α): K[X] → K[α] induces an isomorphism τ: K[X]/(f(X)) → K[α]. Similarly, h(X) ↦ h(α′): K[X] → K[α′] induces an isomorphism τ′: K[X]/(f(X)) → K[α′], and we set σ = τ′ ∘ τ^{−1}.

Proposition 2.11. Let L be a field containing A. An element α of L is integral over A if and only if there is a finitely generated A-module M ≠ 0 in L such that αM ⊂ M (in fact, we can take M = A[α], the A-subalgebra generated by α).

Proof. ⟹ : Suppose

α^{n} + a_{1}α^{n−1} + ... + a_{n} = 0, a_{i} ∈ A.

Then the A-submodule M of L generated by 1, α, ..., α^{n−1} has the property that αM ⊂ M.

⟸ : We shall need to apply Cramer’s rule. As usually stated (in linear algebra courses) this says that, if

∑_{j=1}^{m} c_{ij}x_{j} = d_{i}, i = 1, …, m,

then

x_{j} = det(C_{j})/ det(C)

where C = (c_{ij}) and C_{j} is obtained from C by replacing the elements of the j^{th} column with the d_{i}s. When one restates the equation as

det(C) · x_{j} = det(C_{j})

it becomes true over any ring (whether or not det(C) is invertible). The proof is elementary—essentially it is what you wind up with when you eliminate the other variables (try it for m = 2). Alternatively, expand out

det C_{j} = | \begin{matrix}c_{11} & … & − ∑ c_{1j}x_{j} & … & c_{1m} \\ & … & & … \\ c_{m1} & … & − ∑ c_{mj}x_{j} & … & c_{mm} \end{matrix} |

using standard properties of determinants.

Now let M be a nonzero A-module in L such that αM ⊂ M, and let v_{1}, …, v_{n} be a finite set of generators for M. Then, for each i,

αv_{i} = ∑ a_{ij}v_{j}, some a_{ij} ∈ A.

We can rewrite this system of equations as

(α − a_{11})v_{1} − a_{12}v_{2} − a_{13}v_{3} − … = 0
−a_{21}v_{1} + (α − a_{22})v_{2} − a_{23}v_{3} − … = 0
. . . . . . . . .

Let C be the matrix of coefficients on the left-hand side. Then Cramer’s rule tells us that det(C) · v_{i} = 0 for all i. Since at least one v_{i} is nonzero and we are working inside the field L, this implies that det(C) = 0. On expanding out the determinant, we obtain an equation

α^{n} + c_{1}α^{n−1} + c_{2}α^{n−2} + … + c_{n} = 0, c_{i} ∈ A. □

We now give a second proof that if A is a subring of a field L, and B is the set of elements of L that are integral over A, then B is a ring. Let α and β be two elements of L integral over A, and let M and N be finitely generated A-modules in L such that αM ⊂ M and βN ⊂ N. Define

MN = {∑ m_{i}n_{i} | m_{i} ∈ M, n_{i} ∈ N}.

Then:

(a) MN is an A-submodule of L (easy);

(b) it is finitely generated—if {e_{1}, …, e_{m}} generates M and {f_{1}, …, f_{n}} generates N, then {e_{1}f_{1}, …, e_{i}f_{j}, …, e_{m}f_{n}} generates MN;

(c) it is stable under multiplication by αβ and by α ± β. We can now apply (2.11) to deduce that αβ and α ± β are integral over A. □

Proposition 2.12. If B is integral over A and finitely generated as an A-algebra, then it is finitely generated as an A-module.

Proof. First consider the case that B is generated as an A-algebra by a single element, say B = A[β]. By assumption

β^{n} + a_{1}β^{n−1} + ⋯ + a_{n} = 0, some a_{i} ∈ A.

Every element of B is of the form

c_{0} + c_{1}β + c_{2}β^{2} + ⋯,

and we can exploit the preceding equality to replace β^{n} (successively) with a linear combination of lower powers of β. Thus every element of B is of the form

c_{0} + c_{1}β + c_{2}β^{2} + ⋯ + c_{n−1}β^{n−1},

i.e., 1, β, β^{2}, …, β^{n−1} generate B as an A-module. In order to pass to the general case, we need a lemma.

Lemma 2.13. Let A ⊂ B ⊂ C be rings. If B is finitely generated as an A-module, and C is finitely generated as a B-module, then C is finitely generated as an Amodule.

Proof. If {β_{1}, ..., β_{m}} is a set of generators for B as an A-module, and {γ_{1}, ..., γ_{n}} is a set of generators for C as a B-module, then {β_{i}γ_{j}} is a set of generators for C as an A-module. □

We now complete the proof of (2.12). Let β_{1}, …, β_{m} generate B as an A-algebra, and consider

A ⊂ A[β_{1}] ⊂ A[β_{1}, β_{2}] ⊂ ... ⊂ A[β_{1}, ..., β_{m}] = B.

We saw above that A[β_{1}] is finitely generated as an A-module. Since A[β_{1}, β_{2}] = A[β_{1}][β_{2}], and β_{2} is integral over A[β_{1}] (because it is over A), the same observation shows that A[β_{1}, β_{2}] is finitely generated as a A[β_{1}]-module. Now the lemma shows that A[β_{1}, β_{2}] is finitely generated as an A-module. Continuing in this fashion, we find that B is finitely generated as an A-module. □

Proposition 2.14. Consider integral domains A ⊂ B ⊂ C; if B is integral over A, and C is integral over B, then C is integral over A.

Proof. Let γ ∈ C; it satisfies an equation

γ^{n} + b_{1}γ^{n−1} + … + b_{n} = 0, b_{i} ∈ B.

Let B′ = A[b_{1}, ..., b_{n}]. Then B′ is finitely generated as an A-module (by the last proposition), and γ is integral over B′ (by our choice of the b_{i}), and so B′[γ] is finitely generated as an A-module. Since γB′[γ] ⊂ B′[γ], Proposition 2.11 shows that γ is integral over A. □

Corollary 2.15. Assume that L is algebraic over the field of fractions K of A. Then the integral closure of A in L is integrally closed.

Proof. Let B be the integral closure of A in L. We know from (2.5) that L is the field of fractions of B. If γ ∈ L is integral over B, then the proposition shows that it is integral over A, and so lies in B. □

Remark 2.16. In particular, the ring of integers in a number field is integrally closed. Clearly we want this, since we want our ring of integers to have the best chance of being a unique factorization domain (see 2.7).

Example 2.17. Let k be a finite field, and let K be a finite extension of k(X). Let O_{K} be the integral closure of k[X] in K. The arithmetic of O_{K} is very similar to that of the ring of integers in a number field. If there is time, I may discuss this case later.

Review of bases of A-modules. Let M be an A-module. Recall that a set of elements e_{1}, ..., e_{n} is a basis for M if

(a) ∑ a_{i}e_{i} = 0, a_{i} ∈ A ⟹ all a_{i} = 0, and

(b) every element x of M can be expressed in the form x = ∑ a_{i}e_{i}, a_{i} ∈ A. Let {e_{1}, ..., e_{n}} be a basis for M, and let {f_{1}, ..., f_{n}} be a second set of n elements in M. Then we can write f_{i} = ∑ a_{ij}e_{j}, a_{ij} ∈ A, and f_{i} is also a basis if and only if the matrix (a_{ij}) is invertible in the ring M_{n}(A) of n × n matrices with coefficients in A (this is obvious). Moreover (a_{ij}) is invertible in M_{n}(A) if and only if its determinant is a unit in A, and in this case, the inverse is given by the usual formula:

(a_{ij})^{−1} = adj(a_{ij}) · det(a_{ij})^{−1}.

In the case that A = ℤ, the index of N =_{df} ℤf_{1} + ℤf_{2} + ⋯ + ℤf_{n} in M is | det(a_{ij})| (assuming this is nonzero). To prove this, recall from Math 593 that we can chose bases {e′_{i}} for M and {f′_{i}} for N such that f′_{i} = m_{i}e′_{i}, m_{i} ∈ ℤ. If (e′_{i}) = U · (e_{i}) and (f′_{i}) = V · (f_{i}), then (f_{i}) = V^{−1}DU(e_{i}) where D = diag(m_{1}, …, m_{n}), and

det(V^{−1}DU) = det(V^{−1}) · det(D) · det(U) = ± ∏ m_{i} = ±(M: N).

Review of norms and traces. Let A ⊂ B be rings, and assume that B is a free A-module of rank n. Then any β ∈ B defines an A-linear map

x ↦ βx: B → B,

and the trace and determinant of this map are well-defined. We call them the trace Tr_{B/A} β and norm Nm_{B/A} β of β in the extension B/A. Thus if {e_{1}, ..., e_{n}} is a basis for B over A, and βe_{i} = ∑ a_{ij}e_{j}, then Tr(β) = ∑ a_{ii} and Nm(β) = det(a_{ij}). When B ⊃ A is a finite field extension, this agrees with the usual definition. The following hold:

Tr(β + β′) = Tr(β) + Tr(β′); Tr(aβ) = a Tr(β); Tr(a) = na (a ∈ A);
Nm(ββ′) = Nm(β) · Nm(β′); Nm(a) = a^{n} (a ∈ A).

Proposition 2.18. Let L/K be an extension of fields of degree n, and let β ∈ L. Let f(X) be the minimum polynomial of β over K and let β_{1} = β, β_{2}, ... , β_{m} be the roots of f(X). Then

Tr_{L/K} β = r(β_{1} + ⋯ + β_{m}), Nm_{L/K} β = (β_{1} ⋯ β_{m})^{r}

where r = [L : K[β]] = n/m.

Proof. Suppose first that L = K[β], and compute the matrix of x ↦ βx relative to the basis {1, β, …, β^{n−1}}—one sees easily that it has trace ∑ β_{i} and determinant ∏ β_{i}. For the general case, use the transitivity of norms and traces (see Math. 594). □

Corollary 2.19. Assume L is separable of degree n over K, and let {σ_{1}, ..., σ_{n}} be the set of distinct K-homomorphisms L ↪ Ω where Ω is some big Galois extension of K (e.g., the Galois closure of L over K). Then

Tr_{L/K} β = σ_{1}β + ⋯ + σ_{n}β, Nm_{L/K} β = σ_{1}β ⋯ σ_{n}β.

Proof. Each β_{i} occurs exactly r times in the family {σ_{i}β}—see Math 594. □

Corollary 2.20. Let A be an integrally closed integral domain, and let L be a finite extension of the field of fractions K of A; if β ∈ L is integral over A, then Tr_{L/K} β and Nm_{L/K} β are in A.

Proof. We know that if β is integral, then so also is each of its conjugates. □

Review of bilinear forms. Let V be a finite-dimensional vector space over a field K. A bilinear form on V is a map

ψ : V × V → K

such that x ↦ ψ(x, v) and x ↦ ψ(v, x) are both linear maps V → K for all v ∈ V. The discriminant of a symmetric bilinear form relative to a basis {e_{1}, ..., e_{m}} of V is det(ψ(e_{i}, e_{j})). If {f_{1}, ..., f_{m}} is a set of elements of V, and f_{i} = ∑ a_{ij}e_{i}, then

ψ(f_{k}, f_{l}) = ∑_{i,j} ψ(a_{ki}e_{i}, a_{lj}e_{j}) = ∑_{i,j} a_{ki} · ψ(e_{i}, e_{j}) · a_{lj},

and so

(ψ(f_{k}, f_{l})) = (a_{ki}) · (ψ(e_{i}, e_{j})) · (a_{jl})^{tr}

(equality of m × m matrices). Hence

det(ψ(f_{i}, f_{j})) = det(a_{ij})^{2} · det(ψ(e_{i}, e_{j}))  (2.21)

The form ψ is said to be nondegenerate if it satisfies the following equivalent conditions:

(a) ψ has a nonzero discriminant relative to one (hence every) basis of V;

(b) the left kernel {v ∈ V | ψ(v, x) = 0 for all x ∈ V } is zero;

(c) the right kernel of ψ is zero. Thus if ψ is nondegenerate, the map v ↦ (x ↦ ψ(v, x)) from V onto the dual vector space V^{∨} =_{df} Hom(V, K) is an isomorphism. Let {e_{1}, ..., e_{m}} be a basis for V, and let f_{1}, ..., f_{m} be the dual basis in V^{∨}, i.e., f_{i}(e_{j}) = δ_{ij} (Kronecker delta). We can use the isomorphism V → V^{∨} given by a nondegenerate form ψ to transfer {f_{1}, ..., f_{m}} to a basis {e′_{1}, ..., e′_{m}} of V; it has the property that

ψ(e′_{i}, e_{j}) = δ_{ij}.

For example, suppose {e_{1}, ..., e_{m}} is a basis such that (ψ(e_{i}, e_{j})) is a diagonal matrix—the Gram-Schmidt process always allows us to find such a basis—then e′_{i} = e_{i}/ψ(e_{i}, e_{i}).

Discriminants. If L is a finite extension of K (L and K fields), then

(α, β) ↦ Tr_{L/K}(αβ): L × L → K

is a symmetric bilinear form on L (regarded as a vector space over K), and the discriminant of this form (relative to any basis for L as a K-vector space) is called the discriminant of L/K.

More generally, let B ⊃ A be rings, and assume B is free of rank m as an A-module. Let β_{1}, ..., β_{m} be elements of B. We define their discriminant to be

D(β_{1}, ..., β_{m}) = det(Tr_{B/A}(β_{i}β_{j})).

Lemma 2.22. If γ_{i} = ∑ a_{ij}β_{j}, a_{ij} ∈ A, then

D(γ_{1}, ..., γ_{m}) = det(a_{ij})^{2} · D(β_{1}, ..., β_{m}).

Proof. See the proof of (2.21). □

If the βs and γs both form a basis for B over A, then det(a_{ij}) is a unit (see p26). Thus the discriminant D(β_{1}, ..., β_{m}) of a basis {β_{1}, ..., β_{m}} of B is well-defined up to multiplication by the square of a unit in A. In particular, the ideal in A that it generates is independent of the choice of the basis. This ideal, or D(β_{1}, ..., β_{m}) itself regarded as an element of A/A^{×2}, is called the discriminant disc(B/A) of B over A.

For example, when we have a finite extension of fields L/K, disc(L/K) is an element of K, well-defined up to multiplication by a nonzero square in K.

When A = ℤ, disc(B/A) is a well-defined integer, because 1 is the only square of a unit in ℤ.

Warning: We shall see shortly that, when K is a number field of degree m over ℚ, the ring of integers O_{K} in K is free of rank m over ℤ, and so disc(O_{K}/ℤ) is a well-defined integer—this is often loosely referred to as the discriminant of K/ℚ.

Proposition 2.23. Let A ⊂ B be integral domains, and assume B is a free Amodule of rank m and that disc(B/A) ≠ 0. Elements γ_{1}, ..., γ_{m} form a basis for B as an A-module if and only if

(D(γ_{1}, ..., γ_{m})) = (disc(B/A)) (as ideals in A).

Proof. If {β_{1}, ..., β_{m}} and {γ_{1}, ..., γ_{m}} are bases for B as an A-module, we have already noted that D(β_{1}, ..., β_{m}) and D(γ_{1}, ..., γ_{m}) generate the same ideal.

Conversely, let γ_{1}, ..., γ_{m} be any set of m elements in B, and write γ_{i} = ∑ a_{ij}β_{j}. Then D(γ_{1}, ..., γ_{m}) = det(a_{ij})^{2} · D(β_{1}, ..., β_{m}). If D(γ_{1}, ..., γ_{m}) and D(β_{1}, ..., β_{m}) generate the same ideal and one (hence both) is nonzero, then they differ by a unit (see the proof of 1.2). Thus det(a_{ij}) is a unit, and, as we noted above, this implies that (a_{ij}) is an invertible matrix, and that {γ_{1}, ..., γ_{m}} is also a basis for B as an A-module. □

Remark 2.24. Take A = ℤ in (2.23). Elements γ_{1}, γ_{2}, …, γ_{m} generate a submodule N of finite index in B if and only if D(γ_{1}, …, γ_{m}) ≠ 0, in which case

D(γ_{1}, …, γ_{m}) = (B: N)^{2} · disc(B/ℤ).

To prove this, choose a basis β_{1}, …, β_{m} for B as a ℤ-module, and write γ_{i} = ∑ a_{ij}β_{j}. Then both sides equal det(a_{ij})^{2} · D(β_{1}, …, β_{m}).

Proposition 2.25. Let L be a finite separable extension of the field K, and let σ_{1}, ..., σ_{m} be the distinct K-homomorphisms of L into some large Galois extension Ω of L. Then, for any basis β_{1}, ..., β_{m} of L over K,

D(β_{1}, ..., β_{m}) = det(σ_{i}β_{j})^{2} ≠ 0.

Proof. By direct calculation, we have

D(β_{1}, …, β_{m}) =_{df} det(Tr(β_{i}β_{j})) = det(∑_{k} σ_{k}(β_{i}β_{j})) (by 2.19)

= det(∑_{k} σ_{k}(β_{i}) · σ_{k}(β_{j}))

= det(σ_{k}(β_{i})) · det(σ_{k}(β_{j}))

= det(σ_{k}(β_{i}))^{2}.

Suppose that det(σ_{i}β_{j}) = 0. Then there exist c_{1}, ..., c_{m} ∈ Ω such that

∑_{i} c_{i}σ_{i}(β_{j}) = 0 all j.

By linearity, it follows that ∑_{i} c_{i}σ_{i}(β) = 0 for all β ∈ L, but this contradicts the following result. (Apply it with G = L^{×}.) □

Lemma 2.26. (Dedekind’s lemma) Let G be a group and Ω a field, and let σ_{1}, ..., σ_{m} be distinct homomorphisms G → Ω^{×}; then σ_{1}, ..., σ_{m} are linearly independent over Ω, i.e., there do not exist c_{i} ∈ Ω such that x ↦ ∑_{i} c_{i}σ_{i}(x): G → Ω is the zero map.

Proof. See Math 594 (the proof is easy and elementary). □

Corollary 2.27. Let K be the field of fractions of A, and let L be a finite separable extension of K of degree m. If the integral closure B of A in L is free of rank m over A, then disc(B/A) ≠ 0.

Proof. If {β_{1}, ..., β_{m}} is a basis for B as an A-module, then it follows easily from (2.4) that it is also a basis for L as a K-vector space. Hence disc(B/A) represents disc(L/K). □

Remark 2.28. (a) The proposition shows that the K-bilinear pairing

(β, β′) ↦ Tr(β · β′) : L × L → K

is nondegenerate (its discriminant is disc(L/K)).

(b) The assumption that L/K is separable is essential; in fact, if L/K is not separable, then disc(L/K) = 0 (exercise!).

Rings of integers are finitely generated. We now show that O_{K} is finitely generated as a ℤ-module.

Proposition 2.29. Let A be an integrally closed integral domain with field of fractions K, and let B the integral closure of A in a separable extension L of K of degree m. Then B is contained in a free A-module of rank m. If A is a principal ideal domain, then B is itself a free A-module of rank m.

Proof. Let {β_{1}, ..., β_{m}} be a basis for L over K. According to (2.4), there is a d ∈ A such that d · β_{i} ∈ B for all i. Clearly {d · β_{1}, …, d · β_{m}} is still a basis for L as a vector space over K, and so we can assume that each β_{i} ∈ B. Because the trace pairing is nondegenerate, there is a “dual” basis {β′_{1}, ..., β′_{m}} of L over K such that Tr(β_{i} · β′_{j}) = δ_{ij} (see the discussion following (2.21)). We shall show that

Aβ_{1} + Aβ_{2} + ⋯ + Aβ_{m} ⊂ B ⊂ Aβ′_{1} + Aβ′_{2} + ⋯ + Aβ′_{m}.  (2.29.1)

Only the second inclusion requires proof. Let β ∈ B. Then we can write β = ∑ b_{j}β′_{j}, b_{j} ∈ K, and it remains to show that b_{j} ∈ A. As β_{i}, β ∈ B, so also does β · β_{i}, and so Tr(β · β_{i}) ∈ A (see 2.20). But

Tr(β · β_{i}) = Tr(∑_{j} b_{j}β′_{j} · β_{i}) = ∑_{j} b_{j} Tr(β′_{j} · β_{i}) = ∑_{j} b_{j} · δ_{ij} = b_{i}.

Hence b_{i} ∈ A.

If A is a principal ideal domain, then B is free of rank ≤ m as an A-module because it is contained in a free A-module of rank m, and it has rank ≥ m because it contains a free A-module of rank m. □

Corollary 2.30. The ring of integers in a number field L is the largest subring that is finitely generated as a ℤ-module.

Proof. We have just seen that it is finitely generated as a ℤ-module. Let B be another subring of L that is finitely generated as a ℤ-module; then every element of B is integral over ℤ (by 2.11), and so B ⊂ O_{L}.

Remark 2.31. (a) The hypothesis that L/K be separable is necessary to conclude that B is a finitely generated A-module (we used that the trace pairing was nondegenerate). However it is still true that the integral closure of k[X] in any finite extension of k(X) (not necessarily separable) is a finitely generated k[X]-module.

(b) The hypothesis that A be a principal ideal domain is necessary to conclude from (2.29.1) that B is a free A-module. Consider for example A = ℤ[\sqrt{−5}], and the A-modules

(2) ⊂ (2, 1 + \sqrt{−5}) ⊂ ℤ[\sqrt{−5}].

Both (2) and ℤ[\sqrt{−5}] are free ℤ[\sqrt{−5}]-modules of rank 1, but (2, 1 + \sqrt{−5}) is not a free ℤ[\sqrt{−5}]-module of rank 1, because it is not a principal ideal (see the Introduction). In fact, it is not a free module of any rank.

When K is a number field, a basis α_{1}, ..., α_{m} for O_{K} as a ℤ-module is called an integral basis for K.

Remark 2.32. We retain the notations of the proposition and its proof. (a) Let C = ∑ Aβ_{i} ⊂ B, with β_{i} a basis for L over K. Define

C^{∗} = {β ∈ L | Tr(βγ) ∈ A for all γ ∈ C}.

By linearity,

β ∈ C^{∗} ⟺ Tr(ββ_{i}) ∈ A for i = 1, ..., m,

and it follows that

C^{∗} = ∑ Aβ′_{i}.

Thus we have:

C = ∑ Aβ_{i} ⊂ B ⊂ ∑ Aβ′_{i} = C^{∗}.

(b) Write L = K[β] with β ∈ B, and let f(X) be the minimum polynomial of β. Let C = ℤ[β] = ℤ1 + ℤβ + ⋯ + ℤβ^{m−1}. We want to find C^{∗}.

One can show (see Fröhlich and Taylor p128) that

Tr(β^{i}/f′(β)) = 0 if 0 ≤ i ≤ m − 2, and Tr(β^{m−1}/f′(β)) = 1

(these formulas go back to Euler). It follows from this that

det(Tr(β^{i} · β^{j}/f′(β)) = (−1)^{m}

(the only term contributing to the determinant is the product of the elements on the other diagonal). If β′_{1}, ..., β′_{m} is the dual basis to 1, β, …, β^{m−1}, so that Tr(β^{i}·β′_{j}) = δ_{ij}, then

det(Tr(β^{i} · β′_{j})) = 1.

On comparing these formulas, one sees that the matrix relating the family {1/f′(β), ..., β^{m−1}/f′(β)} to the basis β′_{1}, ..., β′_{m} has determinant ±1, and so it is invertible in M_{n}(A). Thus we see that C^{∗} is a free A-module with basis {1/f′(β), …, β^{m−1}/f′(β)}:

C = A[β] ⊂ B ⊂ f′(β)^{−1}A[β] ⊂ C^{∗}.

Finding the ring of integers. We now assume K to be a field of characteristic zero.

Proposition 2.33. Let L = K[β] some β, and let f(X) be the minimum polynomial of β over K. Write f(X) = ∏(X − β_{i}), β_{i} in the Galois closure of L. Then

D(1, β, β^{2}, …, β^{m−1}) = ∏_{1≤i<j≤m}(β_{i} − β_{j})^{2} = (−1)^{m(m−1)/2} · Nm_{L/K}(f′(β)).

Proof. We have

D(1, β, β^{2}, …, β^{m−1}) = det(σ_{i}(β^{j}))^{2}  (2.25)

= det(β_{i}^{j})^{2}

= (∏_{i<j}(β_{i} − β_{j}))^{2} (Vandermonde)

= (−1)^{m(m−1)/2} · ∏_{i}(∏_{j≠i}(β_{i} − β_{j}))

= (−1)^{m(m−1)/2} · ∏_{j} f′(β_{j})

= (−1)^{m(m−1)/2} Nm(f′(β)). □

The number in (2.33) is called the discriminant of f(X). It can also be defined as the resultant of f(X) and f′(X). The discriminant of f lies in K, and it is zero if and only if f has a repeated root. It is a symmetric polynomial in the β_{i} with coefficients in A, and so (by 2.1) it can be expressed in terms of the coefficients of f(X), but the formulas are quite complicated.

Example 2.34. We compute the discriminant of

f(X) = X^{n} + aX + b, a, b ∈ K,

assumed to be irreducible and separable. Let β be a root of f(X), and let γ = f′(β) = nβ^{n−1} + a. We compute Nm(γ). On multiplying the equation

β^{n} + aβ + b = 0

by nβ^{−1} and rearranging, we obtain the equation

nβ^{n−1} = −na − nbβ^{−1}.

Hence

γ = nβ^{n−1} + a = −(n − 1)a − nbβ^{−1}.

Solving for β gives

β = \frac{−nb}{γ + (n − 1)a},

from which it is clear that K[β] = K[γ], and so the minimum polynomial of γ over K has degree n also. If we write

f(\frac{−nb}{X + (n − 1)a}) = P (X)/Q(X),

then P (γ) = f(β) = 0. Since

P (X) = (X + (n − 1)a)^{n} − na(X + (n − 1)a)^{n−1} + (−1)^{n}n^{n}b^{n−1}

is monic of degree n, it must be the minimum polynomial of γ. Therefore Nm(γ) is (−1)^{n} times the constant term of this polynomial, and so we find that

Nm(γ) = n^{n}b^{n−1} + (−1)^{n−1}(n − 1)^{n−1}a^{n}.

Finally we obtain the formula:

disc(X^{n} + aX + b) = (−1)^{n(n−1)/2}(n^{n}b^{n−1} + (−1)^{n−1}(n − 1)^{n−1}a^{n}).

For example:

disc(X^{2} + aX + b) = −4b + a^{2},

disc(X^{3} + aX + b) = −27b^{2} − 4a^{3},

disc(X^{4} + aX + b) = 256b^{3} − 27a^{4},

disc(X^{5} + aX + b) = 5^{5}b^{4} + 4^{4}a^{5}.

For any polynomials more complicated than the above, use Maple (or Mathematica). For example, after starting Maple, type:

discrim(Xˆ 3 + a*Xˆ 2 + b*X + c, X); Don’t forget the semicolon at the end! The program displays:

−27c^{2} + 18cab + a^{2}b^{2} − 4a^{3}c − 4b^{3}.

Since it is awkward in AMS-TEX to write a polynomial in the notation Maple understands, in future I’ll use normal notation and leave you to insert asterisks and hats. To compute discriminants with Mathematica, you compute the resultant of f(X) and f′(X).

The general strategy for finding the ring of integers of K is to write K = ℚ[α] with α an integer in K, and compute D(1, α, ..., α^{m−1}). It is an integer, and if it is square-free, then {1, α, ..., α^{m−1}} is automatically an integral basis, because (see 2.24)

D(1, α, …, α^{m−1}) = disc(O_{K}/ℤ) · (O_{K}: ℤ[α])^{2}.

If it is not square-free, {1, α, ..., α^{m−1}} may still be a basis, and sometimes one can tell this by using Stickleberger’s theorem (see below) or by looking at how primes ramify (see later). If {1, α, ..., α^{m−1}} is not an integral basis, one has to look for algebraic integers not in ∑ ℤ · α^{i} (we describe an algorithm below).

Example 2.35. Let α be a root of the polynomial X^{3} − X − 1 (cubic polynomial in ℤ[X] with the smallest discriminant). Check that X^{3} − X − 1 is irreducible in ℚ[X] (if it factors, it has a root in ℚ which would be an integer). We have

D(1, α, α^{2}) = disc(f(X)) = −23,

which contains no square factor, and so ℤ[α] is the ring of integers in ℚ[α]— {1, α, α^{2}} is an integral basis for ℚ[α].

Example 2.36. Let α be a root of the polynomial X^{3} + X + 1. Then D(1, α, α^{2}) = disc(f(X)) = −31, which contains no square factor, and so again {1, α, α^{2}} is an integral basis for ℚ[α].

Example 2.37. This example goes back to Dedekind. Let K = ℚ[α], where α is a root of

f(X) = X^{3} + X^{2} − 2X + 8.

Maple computes disc(f(X)) = −4 · 503, but Dedekind showed that O_{K} ≠ ℤ[β], and so disc(O/ℤ) = −503. In fact Dedekind showed that there is no integral basis of the form 1, β, β^{2}. (For another example of this type, see Homework #2.)

Example 2.38. Consider the field ℚ[α] where α is a root of f(X) = X^{5} − X − 1. This polynomial is irreducible, because it is irreducible in 𝔽_{3}[X]. The discriminant of f(X) is 2869 = 19 · 151, and so the ring of integers is ℤ[α].

Proposition 2.39. Let K be an algebraic number field.

(a) The sign of disc(K/ℚ) is (−1)^{s}, where 2s is the number of homomorphisms K ↪ ℂ whose image is not contained in ℝ.

(b) (Stickleberger’s theorem) disc(O_{K}/ℤ) ≡ 0 or 1 mod 4.

Proof. (a) Let K = ℚ[α], and let α_{1} = α, α_{2}, ..., α_{r} be the real conjugates of α, and α_{r+1}, ᾱ_{r+1}..., α_{r+s}, ᾱ_{r+s} be the complex conjugates. One sees easily that

sign(disc(1, ..., α^{m−1})) = sign( ∏_{1≤i≤s}(α_{r+i−s} − ᾱ_{r+i−s}))^{2}

(the other terms are either squares of real numbers or occur in conjugate pairs), and this equals (−1)^{s}.

(b) Recall that disc(O_{K}/ℤ) = det(σ_{i}α_{j})^{2}, where α_{1}, ..., α_{m} is an integral basis. Let P be the sum of the terms in the expansion of det(σ_{i}α_{j}) corresponding to even permutations, and −N the sum of the terms corresponding to odd permutations. Then

disc(O_{K}/ℤ) = (P − N)^{2} = (P + N)^{2} − 4P N.

If τ is an element of the Galois group of the Galois closure of K over ℚ, then either τP = P and τN = N, or τP = N and τN = P. In either case, τ fixes P + N and PN, and so they are rational numbers. As they are integral over ℤ, they must in fact be integers, from which it follows that

disc(O_{K}/ℤ) ≡ (P + N)^{2} ≡ 0 or 1 mod 4. □

Example 2.40. Consider the field ℚ[\sqrt{m}], where m is a square-free integer.

Case m ≡ 2, 3 mod 4. Here D(1, \sqrt{m}) = disc(X^{2} − m) = 4m, and so Stickleberger’s theorem shows that disc(O_{K}/ℤ) = 4m, and hence \{1, \sqrt{m}\} is an integral basis.

Case m ≡ 1 mod 4. First verify that (1 + \sqrt{m})/2 is integral. Then D(1, (1 + \sqrt{m})/2) = m, and so \{1, (1 + \sqrt{m})/2\} is an integral basis.

Remark 2.41. Let K and K′ be number fields. If K and K′ are isomorphic, then [K: ℚ] = [K′: ℚ] and disc(O_{K}/ℤ) = disc(O_{K′}/ℤ), but the converse is not true. For example, there are four nonisomorphic cubic number fields with discriminant -4027 (4027 is prime) (see later for two of them).

The curious may wonder why we didn’t give an example of a field generated by an integral element whose minimum polynomial has discriminant ±1. The reason is that there is no such polynomial of degree > 1—see later.

Algorithms for finding the ring of integers. By an algorithm I mean a procedure that could (in principle) be put on a computer and is guaranteed to lead to the answer in a finite number of steps. Suppose the input requires N digits to express it. A good algorithm is one whose running time is < N^{c} for some c. For example, there is no known good algorithm for factoring an integer. By a practical algorithm I mean one that has been (or should have been) put on a computer, and is actually useful.

The following variant of (2.29) is useful. Let A be a principal ideal domain with field of fractions K, and let B be the integral closure of A in a finite separable extension L of K of degree m.

Proposition 2.42. Let β_{1}, ..., β_{m} be a basis for L over K consisting of elements of B, and let d = disc(β_{1}, ..., β_{m}). Then

A · β_{1} + ... + A · β_{m} ⊂ B ⊂ A · (β_{1}/d) + ... + A · (β_{m}/d).

Proof. Let β ∈ B, and write

β = x_{1}β_{1} + ⋯ + x_{m}β_{m}, x_{i} ∈ K.

Let σ_{1}, …, σ_{m} be the distinct K-embeddings of L into some large Galois extension Ω of K. On applying the σs to this equation, we obtain a system of linear equations:

σ_{i}β = x_{1}σ_{i}β_{1} + x_{2}σ_{i}β_{2} + … + x_{m}σ_{i}β_{m}, i = 1, …, m.

Hence by Cramer’s rule

x_{i} = γ_{i}/δ

where δ = det(σ_{i}β_{j}) and γ_{i} is the determinant of the same matrix, but with the ith column replaced with (σ_{i}β). From (2.33), we know that δ^{2} = d. Thus x_{i} = γ_{i}δ/d, and γ_{i}δ is an element of K (because it equals dx_{i}) and is integral over A. Therefore γ_{i}δ ∈ A, which completes the proof. □

Thus there is the following algorithm for finding the ring of integers in a number field K. Write K = ℚ[α] where α is integral over ℚ. Compute d = disc(1, α, ..., α^{m−1}). Then

ℤ[α] ⊂ O_{K} ⊂ d^{−1}ℤ[α].

Note that (d^{−1}ℤ[α]: ℤ[α]) = d^{m}, which is huge but finite. Each coset β + ℤ[α], β ∈ d^{−1}ℤ[α], consists entirely of algebraic integers or contains no algebraic integer. Find a set of representatives β_{1}, ..., β_{n} for ℤ[α] in d^{−1}ℤ[α], and test each to see whether it is integral over ℤ (the coefficents of its minimum polynomial will have denominators bounded by a power of d, and so it is possible to tell whether or not they are integers by computing them with sufficient accuracy).

Unfortunately this method is not practical. For example, the polynomial

f(X) = X^{5} + 17X^{4} + 3X^{3} + 2X^{2} + X + 1

is irreducible^{5} and has discriminant 285401001. Hence, if α is a root of f(X) and K = ℚ[α], then the index of ℤ[α] in ℤ\frac{1}{d} +ℤ\frac{α}{d} +⋯+ℤ\frac{α^{4}}{d} is (285401001)^{5}. [Actually, as luck would have it,

285401001 = 3 · 179 · 233 · 2281

is square-free, and so O_{K} = ℤ[α].] Note Maple can compute minimal polynomials over ℚ. For example, readlib(lattice); minpoly(1.41421356,3); gives the output

X^{2} − 2.

The first line loads the appropriate library, and the second finds the polynomial (not necessarily monic) with small integer coefficients of degree ≤ 3 which comes closest to having 1.414 … as a root.

I now discuss a practical algorithm for finding O_{K} for small degrees and small discriminants from P&Z (see the additional references at the end of this section). The next result will help us get an idea of what should be possible.

5In Maple, type “factor(f(X));” to factor a polynomial over ℚ. It is obvious that there is an algorithm for factoring a polynomial f(X) in ℚ[X]. First divide through by the leading coefficient to make f(X) monic. Then proceed as in the proof of (2.4) to obtain a monic polynomial with coefficients in ℤ. There is a bound on the absolute value of any root of α of the polynomial in terms of the degree and the coefficients (if |α| is too big, then the remaining terms can’t cancel the leading term α^{m}). Therefore there is a bound on the absolute values of the coefficients of the factors of the polynomial, and since these coefficients are integers, it is possible to simply search for them. Alternatively, note that two polynomials in ℤ[X] can be distinguished by looking modulo a sufficiently large prime. Hence factoring polynomials in ℚ[X] is something that can be safely left to the computer.

Lemma 2.43. Let (A, δ) be Euclidean domain, and let M be an m × m matrix with coefficients in A. Then it is possible to put M into upper triangular form by elementary row operations of the following type:

(i) add a multiple of one row to a second; (ii) swap two rows.

Proof. By definition δ: A → ℤ is a function with the following property: for any two elements a, b ∈ A, a ≠ 0, there exist elements q and r such that

b = qa + r, with r = 0 or δ(r) < δ(a).

Apply an operation of type (ii) so that the element of the first column with the minimum δ is in the (1,1)-position. If a_{11} divides all elements in the first column, we can use operations of type (i) to make all the remaining elements of the first column zero. If not, we can use (i) to get an element in the first column that has smaller δ-value than a_{11}, and put that in the (1,1) position. Repeat —eventually, we will have the gcd of the original elements in the first column in the (1,1) position and zeros elsewhere. Then move onto the next column... □

Remark 2.44. (a) The operations (i) and (ii) are invertible in matrices with coefficients in A, and they correspond to multiplying on the left with an invertible matrix in M_{n}(A). Hence we have shown that there exists an invertible matrix U in M_{n}(A) such that UM is upper triangular.

On taking transposes, we find that for any matrix M ∈ M_{n}(A), there is an invertible matrix U in M_{n}(ℤ) such that MU is lower triangular.

(b) Take A = ℤ (for simplicity), and add the (invertible) operation:

(iii) multiply a row by -1. Then it is possible to make the triangular matrix T = UM satisfy the following conditions (assuming det(M) ≠ 0) :

a_{ii} > 0 for all i;

the elements a_{ij} of the j^{th} column satisfy 0 ≤ a_{ij} < a_{jj}.

Then T is unique. It is said to be in Hermite normal form.

Consider the field K = ℚ[α] generated over ℚ by the algebraic integer α with minimum polynomial f(X). Let {ω_{1}, ..., ω_{n}} be a basis for O_{K} as a ℤ-module, and write

A = M · Ω

where A = (1, α, ..., α^{n−1})^{tr} and Ω = (ω_{1}, ..., ω_{n})^{tr}. Choose U such that MU is lower triangular (and in Hermite normal form), and write

A = MU · U^{−1}Ω = T · Ω′.

Here Ω′ =_{df} U^{−1}Ω is again a ℤ-basis for O_{K}, and Ω′ = T^{−1} · A with T^{−1} also lower triangular (but not necessarily with integer coefficients). Thus ω′_{1} = a_{11}1; ω′_{2} = a_{21}1 + a_{22}α; etc, where d · a_{ij} ∈ ℤ, d = | det(M)| = | det(T)|.

Example 2.45. Let K = ℚ[\sqrt{m}], m square-free, m ≡ 1 (mod 4). The integral basis

1, 1/2 + \sqrt{m}/2

is of the above form.

In (P &Z, 4.6), there is an algorithm that, starting from a monic irreducible polynomial

f(X) = X^{n} + a_{1}X^{n−1} + … + a_{n}, a_{n} ∈ ℤ,

constructs an integral basis ω_{1}, ..., ω_{n}, such that

ω_{i} = (∑_{k=1}^{i} a_{ik}α^{i})/N_{i}

where

α is a root of f(X), a_{ik} ∈ ℤ, N_{i} ∈ ℤ, gcd(a_{i1}, ..., a_{ii}) = 1.

In an Appendix, they use it to show that ℚ[α], where α is a root of

f(X) = X^{11} + 101X^{10} + 4151X^{9} + ⋯ − 332150625,

has an integral basis ω_{1} = 1, ω_{2} = (1/2)α + 1/2 ω_{3} = (1/4)α^{2} − 1/4 ω_{4} = (1/8)α^{3} + (1/8)α^{2} − (1/8)α − 1/8 ........... ω_{11} = (1/9103145472000)α^{10} + ⋯ − 4064571/49948672. The discriminant of f is 2^{130} × 3^{12} × 5^{12} × 29^{18} × 82231^{6}, and the index of ℤ[α]

in O_{K} is 2^{56} × 3^{6} × 5^{3} × 29^{9}.

The first step is to compute D(1, α, α^{2}, …) = disc(f(X)) and to find its square factors. Finding the square factors of disc(f(X)) is the most time-consuming part of the algorithm. The time taken to factor an N-digit number is exponential in the number of digits of N. Every computer can factor a 20 digit number easily, but after that it becomes rapidly more difficult. Hundred digit numbers are extremely difficult. Thus this is not a good algorithm in the above sense. Once one has found the square factors of disc(f(X)) the algorithm for computing an integral basis of the above form is good.

Additional references: Pohst and Zassenhaus, Algorithmic Algebraic Number Theory. It provides algorithms for most of the constructions we make in this course. I refer to it as P &Z.

Lenstra, H., Algorithms in Algebraic Number Theory, Bull. AMS, 26, 1992, 211–244.

These two references are quite different: the first concentrates on giving more-or-less practical algorithms for fields of small degree and small discriminant, whereas the second concentrates on finding “good” general algorithms.

§3. Dedekind Domains; Factorization

Presently, we shall define the notion of a Dedekind domain; then we’ll prove:

(i) ideals in Dedekind domains factor uniquely into products of prime ideals; (ii) rings of integers in number fields are Dedekind domains.

First we consider a local version of a Dedekind domain.

Discrete valuation rings. The following conditions on a principal ideal domain are equivalent:

(a) A has exactly one nonzero prime ideal;

(b) up to associates, A has exactly one prime element;

(c) A is local (and is not a field). A ring satisfying these conditions is called a discrete valuation ring.

Example 3.1. The ring ℤ_{(p)} =_{df} \{\frac{m}{n} ∈ ℚ | n not divisible by p\} is a discrete valuation ring with prime element p and prime ideal (p).

Later we shall define discrete valuations, and so justify the name.

If A is a discrete valuation ring and π is a prime element in A, then every nonzero ideal in A is of the form (π^{m}) for a unique m ∈ ℕ. Thus, if 𝔞 is an ideal in A, and 𝔭 denotes the (unique) maximal ideal of A, then 𝔞 = 𝔭^{m} for a well-defined integer m ≥ 0.

Recall that, for an A-module M and an m ∈ M, the annihilator of m

Ann(m) = {a ∈ A | am = 0}.

It is an ideal in A, and it is a proper ideal if m ≠ 0. Suppose A is a discrete valuation ring, and let c be a nonzero element of A. Let M = A/(c). What are the annihilators of the nonzero elements of M. Let b + (c) be such an element. Fix a prime element π of A, and let c = uπ^{m}, b = vπ^{n} with u and v units. Then n < m (else b + (c) = 0 in M), and

Ann(b + (c)) = (π^{m−n}).

Thus, a b for which Ann(b+(c)) is maximal, is of the form vπ^{n−1}, and for this choice Ann(b + (c)) is a prime ideal generated by \frac{c}{b}. We shall exploit these observations in the proof of the next proposition, which gives a criterion for a ring to be a discrete valuation ring.

Proposition 3.2. Let A be an integral domain. If (i) A is Noetherian, (ii) A is integrally closed, and (iii) A has exactly one nonzero prime ideal, then A is a discrete valuation ring (and conversely).

Proof. We have to show that every ideal in A is principal. As a first step, we prove that the nonzero prime ideal in principal. Note that the conditions imply that A is a local ring.

Choose an element c ∈ A, c ≠ 0, c ≠ unit, and consider the A-module M =_{df} A/(c). For any nonzero m ∈ M, the annihilator of m,

Ann(m) = {a ∈ A | am = 0}

is a proper ideal in A. Because A is Noetherian (here we use i), we can choose an m such that Ann(m) is maximal among these ideals. Write m = b + (c) and 𝔭 = Ann(b + (c)). Note that c ∈ 𝔭, and so 𝔭 ≠ 0, and that

𝔭 = {a ∈ A | c|ab}.

I claim that 𝔭 is prime. If not there exist elements x, y ∈ A such that xy ∈ 𝔭 but neither x nor y ∈ 𝔭. Then yb+(c) is a nonzero element of M because y ∉ 𝔭. Consider Ann(yb + (c)). Obviously it contains 𝔭 and it contains x, but this contradicts the maximality of 𝔭 among ideals of the form Ann(m). Hence 𝔭 is prime.

I claim \frac{b}{c} ∉ A. Otherwise b = c · \frac{b}{c} ∈ (c), and m = b + (c) = 0 (in M).

I claim that \frac{c}{b} ∈ A, and 𝔭 = (\frac{c}{b}). By definition, 𝔭b ⊂ (c), and so 𝔭 · \frac{b}{c} ⊂ A, and it is an ideal in A. If 𝔭 · \frac{b}{c} ⊂ 𝔭, then \frac{b}{c} is integral over A (by 2.11, since 𝔭 is finitely generated), and so \frac{b}{c} ∈ A (because of condition ii), but we know \frac{b}{c} ∉ A. . Thus 𝔭 · \frac{b}{c} = A (by iii), and this implies that 𝔭 = (\frac{c}{b}).

Let π = \frac{c}{b}, so that 𝔭 = (π). Let 𝔞 be a proper ideal of A, and consider the sequence

𝔞 ⊂ 𝔞π^{−1} ⊂ 𝔞π^{−2} ⊂ ….

If 𝔞π^{−r} = 𝔞π^{−r−1} for some r, then π^{−1}(𝔞π^{−r}) = 𝔞π^{−r}, and π^{−1} is integral over A, and so lies in A—this is impossible (π is not a unit in A). Therefore the sequence is strictly increasing, and (again because A is Noetherian) it can’t be contained in A. Let m be the smallest integer such that 𝔞π^{−m} ⊂ A but 𝔞π^{−m−1} ⊈ A. Then 𝔞π^{−m} ⊈ 𝔭, and so 𝔞π^{−m} = A. Hence 𝔞 = (π^{m}). □

Dedekind domains. A Dedekind domain is an integral domain A ≠ field such that

(i) A is Noetherian; (ii) A is integrally closed; (iii) every nonzero prime ideal is maximal.

Thus Proposition 3.2 says that a local integral domain is a Dedekind domain if and only if it is a discrete valuation ring.

Proposition 3.3. Let A be a Dedekind domain, and let S be a multiplicative subset of A. Then S^{−1}A is either a Dedekind domain or a field.

Proof. Condition (iii) says that there is no containment relation between nonzero prime ideals of A. If this condition holds for A, then (1.4) shows that it holds for S^{−1}A. Conditions (i) and (ii) follow from the next lemma.

Proposition 3.4. Let A be an integral domain, and let S be a multiplicative subset of A.

(a) If A is Noetherian, then so also is S^{−1}A.

(b) If A is integrally closed, then so also is S^{−1}A.

Proof. (a) Let 𝔞 be an ideal in S^{−1}A. Then 𝔞 = S^{−1}(𝔞 ∩ A) (the proof of this in 1.5 didn’t use that 𝔞 is prime), and so 𝔞 is generated by any (finite) set of generators for 𝔞 ∩ A.

(b) Let α be an element of the field of fractions of A (= field of fractions of S^{−1}A) that is integral over S^{−1}A. Then

α^{m} + a_{1}α^{m−1} + ⋯ + a_{m} = 0, some a_{i} ∈ S^{−1}A.

For each i, there exists an s_{i} ∈ S such that s_{i}a_{i} ∈ A. Set s = s_{1} ⋯ s_{m} ∈ S, and multiply through the equation by s^{m} :

(sα)^{m} + sa_{1}(sα)^{m−1} + ⋯ + s^{m}a_{m} = 0.

This equation shows that sα is integral over A, and so lies in A. Hence α = (sα)/s ∈ S^{−1}A. □

Corollary 3.5. For any nonzero prime ideal 𝔭 in a Dedekind domain, A_{𝔭} is a discrete valuation ring.

Proof. We saw in (1.6a) that A_{𝔭} is local, and the proposition implies that it is Dedekind. □

Unique factorization. The main result concerning Dedekind domains is the following.

Theorem 3.6. Let A be a Dedekind domain. Every proper nonzero ideal 𝔞 of A can be written in the form

𝔞 = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{n}^{r_{n}}

with the 𝔭_{i} distinct prime ideals and the r_{i} > 0; the 𝔭_{i} and the r_{i} are uniquely determined.

The proof will require several lemmas.

Lemma 3.7. Let A be a Noetherian ring; then every ideal 𝔞 in A contains a product of nonzero prime ideals.

Proof. (Note the similarity to the proof of 1.2.) Suppose not, and choose a maximal counterexample 𝔞. Then 𝔞 itself can not be prime, and so there exist elements x and y of A such that xy ∈ 𝔞 but neither x nor y ∈ 𝔞. The ideals 𝔞 + (x) and 𝔞 + (y) strictly contain 𝔞, but their product is contained in 𝔞. Because 𝔞 is a maximal counterexample to the statement of the lemma, each of 𝔞 + (x) and 𝔞 + (y) contains a product of prime ideals, and it follows that 𝔞 contains a product of prime ideals. □

Lemma 3.8. Let A be a ring, and let 𝔞 and 𝔟 be relatively prime ideals in A; for any m, n ∈ ℕ, 𝔞^{m} and 𝔟^{n} are relatively prime.

Proof. If 𝔞^{m} and 𝔟^{n} are not relatively prime, then they are both contained in some prime (even maximal) ideal 𝔭. But if a prime ideal contains a power of an element, then it contains the element, and so 𝔭 ⊃ 𝔞^{m} ⟹ 𝔭 ⊃ 𝔞 and 𝔭 ⊃ 𝔟^{n} ⟹ 𝔭 ⊃ 𝔟. Thus 𝔞 and 𝔟 are both contained in 𝔭, and so they are not relatively prime.

Alternative proof: We are given that there exist elements a ∈ A and b ∈ B such that a + b = 1. Consider

1 = (a + b)^{r} = a^{r} + \binom{r}{1}a^{r−1}b + ⋯ + b^{r}.

If r ≥ m + n, then the term on the right is the sum of an element of 𝔞^{m} with an element of 𝔟^{n}. □

If A is a Dedekind domain, and 𝔭 ≠ 𝔭′ are prime ideals of A, then condition (iii) of the definition implies that 𝔭 and 𝔭′ are relatively prime; the lemma shows that 𝔭^{m} and 𝔭′^{n} are also relatively prime.

Lemma 3.9. Consider a product of rings A × B. If 𝔞 and 𝔟 are ideals in A and B respectively, then 𝔞 × 𝔟 is an ideal in A × B, and every ideal in A × B is of this form. The prime ideals of A × B are the ideals of the form

𝔭 × B (𝔭 a prime ideal of A), A × 𝔭 (𝔭 a prime ideal of B).

Proof. Let 𝔠 be an ideal in A × B, and let

𝔞 = {a ∈ A | (a, 0) ∈ 𝔠}, 𝔟 = {b ∈ B | (0, b) ∈ 𝔠}.

Clearly 𝔞 × 𝔟 ⊂ 𝔠. Conversely, let (a, b) ∈ 𝔠. Then (a, 0) = (a, b) · (1, 0) ∈ 𝔞 and (0, b) = (a, b) · (0, 1) ∈ 𝔟, and so (a, b) ∈ 𝔞 × 𝔟.

Recall that an ideal 𝔠 ⊂ C is prime if and only if C/𝔠 is an integral domain. The map

A × B ⟶ A/𝔞 × B/𝔟, (a, b) ↦ (a + 𝔞, b + 𝔟)

has kernel 𝔞 × 𝔟, and hence induces an isomorphism

A × B/(𝔞 × 𝔟) ≈ A/𝔞 × B/𝔟.

The product of two nonzero rings always has nonzero zero-divisors, and so in order for A × B/(𝔞 × 𝔟) to be prime, we must have 𝔞 = A or 𝔟 = B. Suppose the latter holds. Then A × B/(𝔞 × 𝔟) ≈ A/𝔞, and this is an integral domain if and only if 𝔞 is prime. □

Remark 3.10. The lemma extends in an obvious way to a finite product of rings: the ideals in A_{1} × ⋯ × A_{m} are of the form 𝔞_{1} × ⋯ × 𝔞_{m} with 𝔞_{i} an ideal in A_{i}; moreover, 𝔞_{1} × ⋯ × 𝔞_{m} is prime if and only if there is a j such that 𝔞_{j} is a prime ideal in A_{j} and 𝔞_{i} = A_{i} for i ≠ j.

Lemma 3.11. Let 𝔭 be a maximal ideal of a ring A, and let 𝔮 be the ideal it generates in A_{𝔭}, 𝔮 = 𝔭A_{𝔭}. The map

a + 𝔭^{m} ↦ a + 𝔮^{m}: A/𝔭^{m} ⟶ A_{𝔭}/𝔮^{m}

is an isomorphism.

Proof. We first show that the map is one-to-one. For this we have to show that 𝔮^{m} ∩ A = 𝔭^{m}. But 𝔮^{m} = S^{−1}𝔭^{m}, S = A − 𝔭, and so we have to show that 𝔭^{m} = (S^{−1}𝔭^{m}) ∩ A. An element of (S^{−1}𝔭^{m}) ∩ A can be written a = b/s with b ∈ 𝔭^{m}, s ∈ S, and a ∈ A. Then sa ∈ 𝔭^{m}, and so sa = 0 in A/𝔭^{m}. The only maximal ideal containing 𝔭^{m} is 𝔭 (because 𝔪 ⊃ 𝔭^{m} ⟹ 𝔪 ⊃ 𝔭), and so the only maximal ideal in A/𝔭^{m} is 𝔭/𝔭^{m}; in particular, A/𝔭^{m} is a local ring. As s is not in 𝔭/𝔭^{m}, it is a unit in A/𝔭^{m}, and so sa = 0 in A/𝔭^{m} ⟹ a = 0 in A/𝔭^{m}, i.e., a ∈ 𝔭^{m}.

We now prove that the map is surjective. Let \frac{a}{s} ∈ A_{𝔭}. Because s ∉ 𝔭 and 𝔭 is maximal, we have that (s) + 𝔭 = A, i.e., (s) and 𝔭 are relatively prime. Therefore (s) and 𝔭^{m} are relatively prime, and so there exist b ∈ A and q ∈ 𝔭^{m} such that bs + q = 1. Then b maps to s^{−1} in A_{𝔭}/𝔮^{m} and so ba maps to \frac{a}{s}. More precisely: because s is invertible in A_{𝔭}/𝔮^{m}, \frac{a}{s} is the unique element of this ring such that s\frac{a}{s} = a; since s(ba) = a(1 − q), the image of ba in A_{𝔭} also has this property and therefore equals \frac{a}{s}. □

Remark 3.12. Consider an integral domain A and a multiplicative subset S of A. For an ideal 𝔞 of A, write 𝔞^{e} for the ideal it generates in S^{−1}A; for an ideal 𝔞 of S^{−1}A, write 𝔞^{c} for 𝔞 ∩ A. Then we have shown (1.5; proof of 3.4; proof of 3.11):

𝔞^{ce} = 𝔞 (all ideals 𝔞 of S^{−1}A);

𝔞^{ec} = 𝔞 if 𝔞 is a prime ideal disjoint from S, or if 𝔞 is a power of a maximal ideal 𝔭 and S = A − 𝔭.

We now prove that a nonzero ideal 𝔞 of A can be factored into a product of prime ideals. According to 3.7 (applied to A), 𝔞 contains a product of nonzero prime ideals,

𝔟 = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{m}^{r_{m}}.

We may suppose that the 𝔭_{i} are distinct. Then

A/𝔟 ≈ A/𝔭_{1}^{r_{1}} × ⋯ × A/𝔭_{m}^{r_{m}} ≈ A_{𝔭_{1}}/𝔮_{1}^{r_{1}} × ⋯ × A_{𝔭_{m}}/𝔮_{m}^{r_{m}}

where 𝔮_{i} = 𝔭_{i}A_{𝔭_{i}} is the maximal ideal of A_{𝔭_{i}}. The first isomorphism is given by the Chinese Remainder Theorem (and 3.8), and the second is given by (3.11). Under this isomorphism, 𝔞/𝔟 corresponds to 𝔮_{1}^{s_{1}}/𝔮_{1}^{r_{1}} ×···×𝔮_{m}^{s_{m}}/𝔮_{m}^{r_{m}} for some s_{i} ≤ r_{i} (recall that the rings A_{𝔭_{i}} are all discrete valuation rings). Since this ideal is also the image of 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}} under the isomorphism, we see that

𝔞 = 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}} in A/𝔟.

Both of these ideals contain 𝔟, and so this implies that

𝔞 = 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}}

in A (because there is a one-to-one correspondence between the ideals of A/𝔟 and the ideals of A containing 𝔟).

To complete the proof of Theorem 3.6, we have to prove that the above factorization is unique, but in the course of the proof, we showed that s_{i} is determined by the condition,

𝔞A_{𝔭_{i}} = 𝔮_{i}^{s_{i}}, 𝔮_{i} the maximal ideal in A_{𝔭_{i}}. □

Remark 3.13. Note that

s_{i} > 0 ⟺ 𝔞A_{𝔭_{i}} ≠ A ⟺ 𝔞 ⊂ 𝔭_{i}.

Corollary 3.14. Let 𝔞 and 𝔟 be ideals in A; then

𝔞 ⊂ 𝔟 ⟺ 𝔞A_{𝔭} ⊂ 𝔟A_{𝔭}

for all ideals nonzero prime ideals 𝔭 of A. In particular, 𝔞 = 𝔟 if and only if 𝔞A_{𝔭} = 𝔟A_{𝔭} for all 𝔭.

Proof. The necessity if obvious. For the sufficiency, factor 𝔞 and 𝔟

𝔞 = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{m}^{r_{m}}, 𝔟 = 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}}, r_{i}, s_{i} ≥ 0.

Then

𝔞A_{𝔭_{i}} ⊂ 𝔟A_{𝔭_{i}} ⟺ r_{i} ≥ s_{i},

(recall that A_{𝔭_{i}} is a discrete valuation ring) and r_{i} ≥ s_{i} all i implies 𝔞 ⊂ 𝔟. □

Corollary 3.15. Let A be an integral domain with only finitely many prime ideals; then A is a Dedekind domain if and only if it is a principal ideal domain.

Proof. Assume A is a Dedekind domain. After (3.6), to show that A is principal, it suffices to show that the prime ideals are principal. Let 𝔭_{1}, …, 𝔭_{m} be these ideals. Choose an element x_{1} ∈ 𝔭_{1} − 𝔭_{1}^{2}. According to the Chinese Remainder Theorem (1.7), there is an element x ∈ A such that

x ≡ x_{1} mod 𝔭_{1}^{2}, x ≡ 1 mod 𝔭_{i}, i ≠ 1.

Now the ideals 𝔭_{1} and (x) generate the same ideals in A_{𝔭_{i}} for all i, and so they are equal in A (by 3.14). □

Corollary 3.16. Let 𝔞 ⊃ 𝔟 ≠ 0 be two ideals in a Dedekind domain; then 𝔞 = 𝔟 + (a) for some a ∈ A.

Proof. Let 𝔟 = 𝔭_{1}^{r_{1}}...𝔭_{m}^{r_{m}} and 𝔞 = 𝔭_{1}^{s_{1}}...𝔭_{m}^{s_{m}}. Because 𝔟 ⊂ 𝔞, s_{i} ≤ r_{i} all i. For 1 ≤ i ≤ m, choose an x_{i} ∈ A such that x_{i} ∈ 𝔭_{i}^{s_{i}}, x ∉ 𝔭_{i}^{s_{i}+1}. By the Chinese Remainder Theorem, there is an a ∈ A such that

a ≡ x_{i} mod 𝔭_{i}^{r_{i}}, all i.

Now one sees that 𝔟 + (a) = 𝔞 by looking at the ideals they generate in A_{𝔭} for all 𝔭. □

Corollary 3.17. Let 𝔞 be an ideal in a Dedekind domain, and let a be any nonzero element of A; then there exists a b ∈ 𝔞 such that 𝔞 = (a, b).

Proof. Apply (3.16) to 𝔞 ⊃ (a).

Corollary 3.18. Let 𝔞 be a nonzero ideal in a Dedekind domain; then there exists a nonzero ideal 𝔞^{∗} in A such that 𝔞𝔞^{∗} is principal. Moreover, 𝔞^{∗} can be chosen to be relatively prime to any particular ideal 𝔠, and it can be chosen so that 𝔞𝔞^{∗} = (a) with a any particular element of 𝔞 (but not both).

Proof. Let a ∈ 𝔞, a ≠ 0; then 𝔞 ⊃ (a), and so we have

(a) = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{m}^{r_{m}} and 𝔞 = 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}}, s_{i} ≤ r_{i}.

If 𝔞^{∗} = 𝔭_{1}^{r_{1}−s_{1}} ⋯ 𝔭_{m}^{r_{m}−s_{m}}, then 𝔞𝔞^{∗} = (a).

We now show that 𝔞^{∗} can be chose to be prime to 𝔠. We have 𝔞 ⊃ 𝔞𝔠, and so (by 3.16) there exists an a ∈ 𝔞 such that 𝔞 = 𝔞𝔠 + (a). As 𝔞 ⊃ (a), we have (a) = 𝔞 · 𝔞^{∗} for some ideal 𝔞^{∗} (by the above argument); now, 𝔞𝔠 + 𝔞𝔞^{∗} = 𝔞, and so 𝔠 + 𝔞^{∗} = A. (Otherwise 𝔠 + 𝔞^{∗} ⊂ 𝔭 some prime ideal, and 𝔞𝔠 + 𝔞𝔞^{∗} = 𝔞(𝔠 + 𝔞^{∗}) ⊂ 𝔞𝔭 ≠ 𝔞.) □

In Math 593, it is shown that

A a principal ideal domain ⟹ A is a unique factorization domain. The converse is false (e.g., k[X, Y], k a field, is a unique factorization domain but the ideal (X, Y) is not principal), but it is true for Dedekind domains.

Proposition 3.19. A Dedekind domain is a unique factorization domain if and only if it is a principal ideal domain.

Proof. Let A be a Dedekind domain with unique factorization. It suffices to show that the nonzero prime ideals are principal—let 𝔭 be such an ideal. It will contain a nonzero element, which (because of 1.2) is a product of irreducible elements. Because 𝔭 is prime, it will contain one of the irreducible factors π, and we know from (3.18) that there exists an ideal 𝔭^{∗} such that 𝔭𝔭^{∗} = (π). I will show that 𝔭^{∗} = A, and so 𝔭 = (π). From (3.18) we know that there are ideals 𝔮 and 𝔮^{∗} such that

𝔭𝔮 = (a), 𝔮 + 𝔭^{∗} = A; 𝔮𝔮^{∗} = (b), 𝔮^{∗} + 𝔭 = A

for some a, b ∈ A. Since (πb) = 𝔭𝔭^{∗}𝔮𝔮^{∗} = (a)𝔭^{∗}𝔮^{∗}, we see that a|πb, and so c = \frac{πb}{a} ∈ A. Then πb = ac, and because A is a unique factorization domain, this implies that π|a or π|c.

If π|a, then \frac{a}{π} ∈ A, and (\frac{a}{π})𝔭^{∗} = 𝔮. Thus any prime ideal dividing 𝔭^{∗} will also divide 𝔮, and this is impossible because 𝔮 and 𝔭^{∗} are relatively prime. Therefore, there is no such ideal, and 𝔭^{∗} = A in this case.

Similarly, if π|c, then (\frac{c}{π})𝔭 = 𝔮^{∗}, which is impossible because 𝔭 does not divide 𝔮^{∗} (𝔮^{∗} is relatively prime to 𝔭). Thus this case does not occur. □

The ideal class group. Let A be a Dedekind domain. A fractional ideal of A is a nonzero A-submodule 𝔞 of K such that

d𝔞 =_{df} {da | a ∈ 𝔞} ⊂ A

for some d ∈ A (or K), i.e., it is a nonzero A-submodule of K whose elements have a common denominator. Note that a fractional ideal is not an ideal—when necessary to avoid confusion, we refer to ideals in A as integral ideals.

Equivalently, a fractional ideal of A can be defined to be a nonzero finitely generated A-submodule of K: a common denominator for the generators will be a common denominator for all the elements of the module, and, conversely, if d𝔞 is an integral ideal, it is finitely generated, and this implies that 𝔞 is finitely generated.

Every nonzero element b of K defines a fractional ideal

(b) =_{df} bA =_{df} {ba | a ∈ A}.

An ideal of this type is said to be principal.

The product of two fractional ideals is defined in the same way as for (integral) ideals

𝔞 · 𝔟 = {∑ a_{i}b_{i} | a_{i} ∈ 𝔞, b_{i} ∈ 𝔟}.

This is again a fractional ideal: it is obviously an A-module, and if d𝔞 ⊂ A and e𝔟 ⊂ A, then de𝔞𝔟 ⊂ A. For principal fractional ideals, (a)(b) = (ab).

Example 3.20. Let A be a discrete valuation ring with maximal ideal 𝔭 and field of fractions K. Write π for a generator of 𝔭. Every nonzero element of K can be written uniquely in the form a = uπ^{m} with u a unit in A and m ∈ ℤ. Let 𝔞 be a fractional ideal of A. Then d𝔞 ⊂ A for some d ∈ A, and we can suppose d = π^{n}. Thus π^{n}𝔞 is an ideal in A, and so it is of the form (π^{m}) for some m ≥ 0. Clearly, 𝔞 = (π^{m−n}). Thus the fractional ideals of A are of the form (π^{m}), m ∈ ℤ. They form a free abelian group of rank 1, and the map

m ↦ (π^{m}): ℤ → Id(A)

is an isomorphism.

Theorem 3.21. Let A be a Dedekind domain. The set Id(A) of fractional ideals is a group; in fact, it is the free abelian group on the set of prime ideals.

Proof. We have noted that the law of composition is well-defined. It is obviously commutative. For associativity, one checks that

(𝔞𝔟)𝔠 = {∑ a_{i}b_{i}c_{i} | a_{i} ∈ 𝔞, b_{i} ∈ 𝔟, c_{i} ∈ 𝔠} = 𝔞(𝔟𝔠).

The ring A plays the role of an identity element: 𝔞A = 𝔞. In order to show that Id(A) is a group, it remains to show that inverses exist.

Let 𝔞 be a nonzero integral ideal. According to (3.18), there is an ideal 𝔞^{∗} and an a ∈ A such that 𝔞𝔞^{∗} = (a). Clearly 𝔞 · (a^{−1}𝔞^{∗}) = A, and so a^{−1}𝔞^{∗} is an inverse of 𝔞. If 𝔞 is a fractional ideal, then d𝔞 is an integral ideal for some d, and d · (d𝔞)^{−1} will be an inverse for 𝔞.

It remains to show that the group Id(A) is freely generated by the prime ideals, i.e., that each fractional ideal can be expressed in a unique way as a product of powers of prime ideals. Let 𝔞 be a fractional ideal. Then d𝔞 is an integral ideal for some d ∈ A, and we can write

d𝔞 = 𝔭_{1}^{r_{1}} ⋯ 𝔭_{m}^{r_{m}}, (d) = 𝔭_{1}^{s_{1}} ⋯ 𝔭_{m}^{s_{m}}.

Thus 𝔞 = 𝔭_{1}^{r_{1}−s_{1}} ⋯ 𝔭_{m}^{r_{m}−s_{m}}. The uniqueness follows from the uniqueness of the factorization for integral ideals. □

Remark 3.22. (a) Conversely, Noether showed that an integral domain whose fractional ideals form a group under ideal multiplication is a Dedekind domain (see Cohn p4.6).

(b) Let S be a multiplicative subset in a Dedekind domain A, and let A_{S} = S^{−1}A. It is an integral domain with the same field of fractions as A:

A ⊂ A_{S} ⊂ K.

For any fractional ideal 𝔞 of A, S^{−1}𝔞 =_{df} \{\frac{a}{s} | a ∈ 𝔞, s ∈ S\} is a fractional ideal of A_{S}. It is the A_{S}-module generated by 𝔞. The following hold for any fractional ideals 𝔞 and 𝔟,

S^{−1}(𝔞𝔟) = (S^{−1}𝔞)(S^{−1}𝔟), S^{−1}𝔞^{−1} = (𝔞A_{S})^{−1}.

For any fractional ideal 𝔞, define

𝔞′ = {a ∈ K | a𝔞 ⊂ A}.

This is an A-module, and if d ∈ 𝔞, d ≠ 0, then d𝔞′ ⊂ A, and so 𝔞 is a fractional ideal. From the definition of 𝔞′, we see that 𝔞𝔞′ is an ideal in A. If it is not equal to A, then it is contained in some prime ideal 𝔭. When we pass to A_{𝔭}, the inclusion 𝔞𝔞′ ⊂ 𝔭 becomes 𝔟𝔟′ ⊂ 𝔮, where 𝔟, 𝔟′, and 𝔮 are the ideals in A_{𝔭} generated by 𝔞, 𝔞′, and 𝔭. Moreover,

𝔟′ = {a ∈ K | a𝔟 ⊂ B}.

But 𝔮 = (π), and 𝔟 = (π^{m}) = π^{m} · A for some m ∈ ℤ. Clearly 𝔟′ = π^{−m}A, and so 𝔟𝔟′ = A_{𝔭}—have a contradiction.

We define the ideal class group Cl(A) of A to be the quotient Cl(A) = Id(A)/P(A) of Id(A) by the subgroup of principal ideals. The class number of A is the order of Cl(A) (when finite). In the case that A is the ring of integers O_{K} in a number field K, we refer to Cl(O_{K}) as the ideal class group of K, and its order as the class number of K.

A major theorem of this course will be that the class number h_{K} of a number field K is finite. For example, the class number of ℚ[\sqrt{−m}] for m > 0 and square-free is 1 if and only if m = 1, 2, 3, 7, 11, 19, 43, 67, 163. It not difficult to show that these fields have class number 1, but it was not until 1954 that it was shown (by Heegner) that there were no more (and for more than 15 years, no one believed Heegner’s proof to be correct). We have seen that ℤ[\sqrt{−5}] is not a principal ideal domain, and so can’t have class number 1—in fact it has class number 2. The method we use to prove that the class number is finite is effective: it provides an algorithm for computing it. There are many unsolved problems concerning class numbers: for example, there are expected to be an infinite number of real quadratic fields with class number one, but this has not been proved.

Example 3.23. Consider the elliptic curve

Y^{2} = X^{3} + aX + b, Δ = −4a^{3} − 27b^{2} ≠ 0.

The associated ring A = ℂ[X, Y]/(Y^{2} − X^{3} − aX − b) of regular functions on A is a Dedekind domain, and its class group is uncountable. In fact, it is isomorphic in a natural way to ℂ/Λ for some lattice Λ in ℂ. (Exercise for those familiar with the theory of elliptic curves.) [In fact, every abelian group can be realized as the class group of a Dedekind domain (Claborn, L., Every abelian group is a class group, Pacific J. Math. 18, pp 219–222).

Proposition 3.24. Let A be a Dedekind domain, and let S be a multiplicative set in A. Then 𝔞 ↦ S^{−1}𝔞 gives an isomorphism from the subgroup of Id(A) generated by prime ideals not meeting S to the group Id(S^{−1}A).

Proof. Immediate consequence of 1.5 and 3.21.

Remark 3.25. Let A be a Dedekind domain with finite ideal class group. There is then a finite set of ideals 𝔞_{1}, ..., 𝔞_{m} which is a set of representatives for the ideal classes. Clearly we may take the 𝔞_{i} to be integral. Let b be any element in ∩𝔞_{i}, and let S be the multiplicative set generated by b, S = {1, b, b^{2}, … }. I claim that S^{−1}A is a principal ideal domain.

By assumption, any ideal 𝔞 ⊂ A can be written 𝔞 = (a) · 𝔞_{i} for some a ∈ K^{×} and i, 1 ≤ i ≤ m. Because the map 𝔟 ↦ S^{−1}𝔟 is a homomorphism we have S^{−1}𝔞 = (a) · S^{−1}𝔞_{i} where (a) now denotes the ideal generated by a in S^{−1}A. Since S^{−1}𝔞_{i} contains a unit, it is the whole ring. Thus S^{−1}𝔞 = (a), and we see that every ideal in S^{−1}A of the form S^{−1}𝔞 is principal. According to (3.12), all ideals of S^{−1}A are of this form.

Remark 3.26. The following conditions on an integral domain A are equivalent:

(a) A is a Dedekind domain;

(b) for every prime ideal 𝔭 of A, A_{𝔭} is a discrete valuation ring;

(c) the fractional ideals of A form a group;

(d) for every fractional ideal 𝔞 of A, there is an ideal 𝔟 such that 𝔞𝔟 = A.

We have seen that (a) ⟹ (b), (c), and (d) is certainly implied by (c). The converses can be found in several books (e.g., Atiyah-MacDonald).

Discrete valuations. Let K be a field. A discrete valuation on K is a nonzero homomorphism v: K^{×} → ℤ such that v(a + b) ≥ min(v(a), v(b)). As v is not the zero homomorphism, its image is a nonzero subgroup of ℤ, and is therefore of the form mℤ for some m ∈ ℤ. If m = 1, then v: K^{×} → ℤ is surjective, then v is said to be normalized; otherwise, x ↦ m^{−1} · v(x) will be a normalized discrete valuation.

Example 3.27. (a) Let M be the field of meromorphic functions on a connected open subset U of the complex plane (or, better, a compact Riemann surface). For each P ∈ U, and f ∈ M, f ≠ 0, define ord_{P} (f) to be −m, m, or 0 according as f has a pole of order m at P, a zero of order m at P, or neither a pole nor a zero at P. Then ord_{P} is a normalized discrete valuation on M.

(b) Let A be a principal ideal domain with field of fractions K, and let π be a prime element of A. Then each element c of K^{×} can be written c = π^{m} \frac{a}{b} with a and b elements of A relatively prime to π. Define v_{p}(c) = m. Then v_{p} is a normalized discrete valuation on K.

(c) Let A be a Dedekind domain and let 𝔭 be a prime ideal in A. For any c ∈ K^{×}, let 𝔭^{v(c)} be the power of 𝔭 dividing (c). Then v is a normalized discrete valuation on K.

In all these examples, we have that v(a + b) = v(b) if v(a) > v(b). This is in fact a general property of discrete valuations. First note that v(ζ) = 0 for any element of K^{×} of finite order (v is a homomorphism and ℤ has no elements of finite order); hence v(−a) = v(−1) + v(a) = v(a). Therefore, if v(a) > v(b), we have

v(b) = v(a + b − a)) ≥ min(v(a + b), v(a)) ≥ min(v(a), v(b)) = v(b),

and so equality must hold throughout, and this implies v(a + b) = v(b).

We often use “ord” rather than “v” to denote a discrete valuation; for example, we often use ord_{𝔭} to denote the discrete valuation defined by 𝔭 in (c).

Example (b) shows that every discrete valuation ring gives rise to a discrete valuation on its field of fractions. There is a converse to this statement.

Proposition 3.28. Let v be a discrete valuation on K, then

A =_{df} {a ∈ K | v(a) ≥ 0}

is a principal ideal domain with maximal ideal

𝔪 =_{df} {a ∈ K | v(a) > 0}.

If v(K^{×}) = mℤ, then the ideal 𝔪 is generated by any element π such that v(π) = m.

Proof. Routine. □

Later we shall see that a discrete valuation ord defines a topology on K for which two elements x and y are close if ord(x − y) is large. The Chinese Remainder Theorem can be restated as an approximation theorem.

Proposition 3.29. Let x_{1}, ..., x_{m} be elements of a Dedekind domain A, and let 𝔭_{1}, ..., 𝔭_{m} be distinct prime ideals of A. For any integer n, there is an x ∈ A such that

ord_{𝔭_{i}}(x − x_{i}) > n, i = 1, 2, ..., m.

Proof. From (3.8) we know that the ideals 𝔭_{i}^{n+1} are relatively prime in pairs, and so (1.7) provides us with an element x ∈ A such that

x ≡ x_{i} mod 𝔭_{i}^{n+1}, i = 1, 2, …, m,

i.e, such that

ord_{𝔭_{i}}(x − x_{i}) > n, i = 1, 2, ..., m. □

Integral closures of Dedekind domains. We now prove a result that implies that rings of integers in number fields are Dedekind domains, and hence that their ideals factor uniquely into products of prime ideals.

Theorem 3.30. Let A be a Dedekind domain with field of fractions K, and let B be the integral closure of A in a finite separable extension L of K. Then B is a Dedekind domain.

Proof. We have to check the three conditions on p42.

Let R be a ring (not necessarily an integral domain). An R-module M is said to be Noetherian if every submodule is finitely generated. (Equivalent conditions: every ascending chain of submodules becomes stationary; every nonempty set of submodules contains a maximal element.)

Lemma 3.31. Let R be a Noetherian ring. Then any finitely generated R-module is Noetherian.

Proof. (Sketch) First show that if

0 ⟶ M′ ⟶ M ⟶ M′′ ⟶ 0

is exact and M′ and M are Noetherian, then so also is M; then use induction on the number of generators of M. □

We now show that B is Noetherian. In (2.29) we showed that B is contained in a finitely generated A-module. It follows that every ideal in B is finitely generated when regarded as an A-module (being a submodule of a Noetherian A-module) and a fortiori as an ideal (= B-module).

Next B is integrally closed because of (1.22).

It remains to prove that every nonzero prime ideal 𝔮 of B is maximal. Let β ∈ 𝔮, β ≠ 0. Then β is integral over A, and so there is an equation

β^{n} + a_{1}β^{n−1} + ⋯ + a_{n} = 0, a_{i} ∈ A,

which we may suppose to have the minimum possible degree. Then a_{n} ≠ 0. As a_{n} ∈ βB ∩ A, we have that 𝔮 ∩ A ≠ (0). But 𝔮 ∩ A is a prime ideal (obviously), and so it is a maximal ideal 𝔭 of A, and A/𝔭 is a field. We know B/𝔮 is an integral domain, and the map

a + 𝔭 ↦ a + 𝔮

identifies A/𝔭 with a subfield of B/𝔮. As B is integral over A, B/𝔮 is algebraic over A/𝔭. The next lemma shows that B/𝔮 is a field, and so that 𝔮 is maximal. □

Lemma 3.32. Any integral domain B containing a field k and algebraic over k is itself a field.

Proof. Let β be a nonzero element of B—we have to prove that it has an inverse in B. Because β is algebraic over k, the ring k[β] is finite-dimensional as a k-vector space, and the map x ↦ βx: k[β] → k[β] is injective (because B is an integral domain). From linear algebra we deduce that the map is surjective, and so there is an element β′ ∈ k[β] such that ββ′ = 1. □

In fact, it is not necessary to assume in the statement of Theorem 3.30 that L is separable over K—see Janusz I.6 for a proof of the more general result. The difficulty is that, without the separability condition, B may fail to be finitely generated as an A-module, and so the proof that it is Noetherian is more difficult.

Modules over Dedekind domains*. ^{6} The structure theorem for finitely generated modules over principal ideal domains has an interesting extension to modules over Dedekind domains. Throughout this subsection, A is a Dedekind domain.

6Subsections marked with an asterisk will not be on the final exam.

First, note that a finitely generated torsion-free A-module M need not be free. For example, every nonzero fractional ideal is finitely generated and torsion-free, but it is free if and only if it is principal. Thus the best we can hope for is the following.

Theorem 3.33. Let A be a Dedekind domain.

(a) Every finitely generated torsion-free A-module M is isomorphic to a direct

sum of fractional ideals,

M ≈ 𝔞_{1} ⊕ ⋯ ⊕ 𝔞_{m}.

(b) Two finitely generated torsion-free A-modules M ≈ 𝔞_{1} ⊕ ⋯ ⊕ 𝔞_{m} and N ≈ 𝔟_{1} ⊕ ⋯ ⊕ 𝔟_{n} are isomorphic if and only if m = n and ∏ 𝔞_{i} ≡ ∏ 𝔟_{i} modulo principal ideals.

Thus we see that

M ≈ 𝔞_{1} ⊕ ⋯ ⊕ 𝔞_{m} ≈ A ⊕ ⋯ ⊕ A ⊕ 𝔞_{1} ⋯ 𝔞_{m}.

Moreover, two fractional ideals 𝔞 and 𝔟 of A are isomorphic if and only they differ by a principal ideal.

The rank of a module M over an integral domain R is the dimension of K ⊗ M as a K-vector space, where K is the field of fractions of R. Clearly the rank of M ≈ 𝔞_{1} ⊕ ⋯ ⊕ 𝔞_{m} is m.

These remarks show that the set of isomorphism classes of finitely generated torsion-free R-modules of rank 1 can be identified with the class group of A. Multiplication of elements in Cl(A) corresponds to forming the tensor product of modules.

Theorem 3.34. (Invariant factor theorem) Let M ⊃ N be finitely generated torsion-free A-modules of the same rank m. Then there exist elements e_{1}, ..., e_{m} of M, fractional ideals 𝔞_{1}, ..., 𝔞_{m}, and integral ideals 𝔟_{1} ⊃ 𝔟_{2} ⊃ ... ⊃ 𝔟_{m} such that

M = 𝔞_{1}e_{1} ⊕ ⋯ ⊕ 𝔞_{m}e_{m}, N = 𝔞_{1}𝔟_{1}e_{1} ⊕ ⋯ ⊕ 𝔞_{m}𝔟_{m}e_{m}.

The ideals 𝔟_{1}, 𝔟_{2}, ..., 𝔟_{m} are uniquely determined by the pair M ⊃ N, and are called the invariant factors of N in M.

The last theorem yields a description of finitely generated torsion A-modules. For proofs of the above results, see Curtis and Reiner, Representation Theory of

Finite Groups and Associative Algebras, III.22, or Narkiewisz, I.3.

Factorization in extensions. Let A be a Dedekind domain with field of fractions K, and let B be the integral closure of A in a finite (separable) extension L of K.

A prime ideal 𝔭 of A will factor in B, 𝔭B = 𝔓_{1}^{e_{1}} ⋯ 𝔓_{g}^{e_{g}}, e_{i} ≥ 1.

If any of the numbers is > 1, then we say that 𝔭 is ramified in B (or L). The number e_{i} is called the ramification index. We say 𝔓 divides 𝔭 (written 𝔓|𝔭) if 𝔓 occurs in the factorization of 𝔭 in B. We then write e(𝔓/𝔭) for the ramification index and f(𝔓/𝔭) for the degree of the field extension [B/𝔓: A/𝔭] (called the residue class degree).

Lemma 3.35. A prime ideal 𝔓 of B divides 𝔭 if and only if 𝔭 = 𝔓 ∩ K.

Proof. ⇒: Clearly 𝔭 ⊂ 𝔓 ∩ K, and we can’t have 𝔓 ∩ K = A.

⇐: If 𝔭 ⊂ 𝔓 then 𝔭B ⊂ 𝔓, and we have seen (3.13) that this implies that 𝔓 occurs in the factorization of 𝔭B. □

Theorem 3.36. Let m be the degree of L over K, and let 𝔓_{1}, ..., 𝔓_{g} be the primes dividing 𝔭; then

∑_{i=1}^{g} e_{i}f_{i} = m.

If L is Galois over K, then all the ramification numbers are equal, and all the residue class degrees are equal, and so

efg = m.

Proof. To prove the first part of the theorem we shall show that

∑ e_{i}f_{i} = [B/𝔭B: A/𝔭] = m.

For the first equality, note that B/𝔭B = B/ ∏ 𝔓_{i}^{e_{i}} = ∏ B/𝔓_{i}^{e_{i}} (Chinese Remainder Theorem), and so we have to show that [B/𝔓_{i}^{e_{i}}: A/𝔭] = e_{i}f_{i}. From the definition of f_{i}, we know that B/𝔓_{i} is a field of degree f_{i} over A/𝔭. For each r, 𝔓_{i}^{r_{i}}/𝔓_{i}^{r_{i+1}} is a B/𝔓_{i}-module, and because there is no ideal between 𝔓_{i}^{r_{i}} and 𝔓_{i}^{r_{i+1}}, it must have dimension one as a B/𝔓_{i}-vector space, and hence dimension f_{i} as an A/𝔭_{i}-vector space. Therefore each quotient in the chain

B ⊃ 𝔓_{i} ⊃ 𝔓_{i}^{2} ⊃ ⋯ ⊃ 𝔓_{i}^{e_{i}}

has dimension f_{i} over A/𝔭, and so the dimension of B/𝔓_{i}^{e_{i}} is e_{i}f_{i}.

The proof of the second equality is easy if A is a principal ideal domain: a basis x_{1}, ..., x_{m} for the A-module B is also a basis for the K-vector space L and gives, by reduction mod 𝔭, a basis for B/𝔭B over A/𝔭. [To prove the second statement, note that to say {x_{1}, ..., x_{m}} is a basis for an A-module M means that

A^{m} ⟶ M, (a_{i}) ↦ ∑ a_{i}x_{i}

is an isomorphism. When we tensor this isomorphism with A/𝔞, we obtain an isomorphism

(A/𝔞)^{m} ⟶ M/𝔞M, (a_{i}) ↦ ∑ a_{i}x̄_{i}

(see 1.11), and so {x̄_{1}, ..., x̄_{m}} is a basis for M/𝔞M as an A/𝔞-module.]

Now let S be a multiplicative subset of A disjoint from 𝔭 and such that S^{−1}A is principal (e.g., S = A − 𝔭). Write B′ = S^{−1}B and A′ = S^{−1}A. Then 𝔭B′ = ∏(𝔓_{i}B′)^{e_{i}} (see 3.24), and so ∑ e_{i}f_{i} = [B′/𝔭B′: A′/𝔭A′]; but A′ is principal, and so [B′/𝔭B′: A′/𝔭A′] = m. This completes the proof of the first part of the theorem.

Now assume L is Galois over K. Clearly B is stable under the action of Gal(L/K), and if σ ∈ Gal(L/K) and 𝔓 is a prime ideal of B, then σ𝔓 is also a prime ideal. Moreover, if 𝔓 divides 𝔭, then it follows from (3.35) that σ𝔓 divides 𝔭. Clearly e(σ𝔓/𝔭) = e(𝔓/𝔭) and f(σ𝔓/𝔭) = f(𝔓/𝔭), and so it remains to show that Gal(L/K) acts transitively on the prime ideals of B dividing 𝔭.

Suppose 𝔓 and 𝔔 both divide 𝔭, and suppose 𝔔 is not conjugate to 𝔓, i.e., that for all σ ∈ Gal(L/K), σ𝔓 ≠ 𝔔. According to the Chinese Remainder Theorem, we can find an element β ∈ 𝔔 such that β ∉ σ𝔓 for any σ ∈ Gal(L/K). Consider b = Nm(β) =_{df} ∏ σβ. Then b ∈ A, and as β ∈ 𝔔, it also lies in 𝔔; hence b ∈ 𝔔 ∩ A = 𝔭. On the other hand, for all σ ∈ Gal(L/K), β ∉ σ^{−1}𝔓, and so σβ ∉ 𝔓; the fact that ∏ σβ ∈ 𝔭 ⊂ 𝔓 contradicts the primality of 𝔓. □

The primes that ramify. In this subsection, we obtain a description of the primes that ramify in an extension.

Theorem 3.37. Let L be a finite extension of a number field K, let A be a Dedekind domain in K with field of fractions K (e.g., A = O_{K}), and let B be the integral closure of A in L. Assume that K is a number field and that B is a free A-module (this is true for example if A is principal ideal domain, e.g. A = ℤ). Then a prime 𝔭 ramifies in L if and only if 𝔭| disc(B/A). In particular, only finitely many prime ideals ramify.

Proof. We obtain this as the consequence of a series of lemmas.

Lemma 3.38. Let A be a ring and let B be a ring containing A and admitting a finite basis {e_{1}, ..., e_{m}} as an A-module. For any ideal 𝔞 of A, {ē_{1}, ..., ē_{m}} is a basis for the A/𝔞-module B/𝔞B, and

D(ē_{1}, ..., ē_{m}) ≡ D(e_{1}, ..., e_{m}) mod 𝔞.

Proof. We noted in the proof of (3.36) that ē_{1}, ..., ē_{m} is a basis for B/𝔞B. The second assertion is obvious from the definitions. □

Lemma 3.39. Let A be a ring and let B_{1}, ..., B_{g} be rings containing A and free of finite rank as A-modules. Then

disc((ΠB_{i})/A) = ∏ disc(B_{i}/A).

Proof. Choose bases ε_{i} for each of the B_{i} (as A-modules), and compute the discriminant of B/A using the basis ∪_{i}ε_{i}. □

An element α of a ring is said to be nilpotent if α^{m} = 0 for some m > 1. A ring is said to be reduced if it has no nonzero nilpotent elements.

Lemma 3.40. Let k be a perfect field, and let B be a k-algebra of finite dimension. The B is reduced if and only if disc(B/k) ≠ 0.

Proof. Let β ≠ 0 be a nilpotent element of B, and choose a basis e_{1}, …, e_{m} for B with e_{1} = β. Then βe_{i} is nilpotent for all i, and so the k-linear map

x ↦ βe_{i}x: B → B

is nilpotent. Its matrix is also nilpotent, but a nilpotent matrix has trace zero—its minimum polynomial (and hence its characteristic polynomial) is of the form X^{r}— and so the first row of the matrix (Tr(e_{i}e_{j})) is zero. Therefore its determinant is zero.

Conversely, suppose B is reduced, and let 𝔑 be the intersection of the prime ideals of B. We shall show that 𝔑 = (0). Let b ∈ B, b ≠ 0. Let Σ be the set of ideals of B containing no power of b. Because b is not nilpotent, Σ contains the zero ideal, and hence is nonempty. Clearly B is Noetherian, and so Σ has a maximal element 𝔭. We shall show that 𝔭 is prime. Since b ∉ 𝔭, this will show that b ∉ 𝔑.

Let x, y be elements of B not in 𝔭. Then 𝔭 + (x) and 𝔭 + (y) strictly contain 𝔭, and so

b^{m} ∈ 𝔭 + (x), b^{n} ∈ 𝔭 + (y)

for some m, n, say

b^{m} = p + cx, b^{n} = p′ + c′y, p, p′ ∈ 𝔭, c, c′ ∈ B.

Then b^{m+n} = pp′ + pc′y + p′cx + cc′xy ∈ 𝔭 + (xy), and so 𝔭 + (xy) is not in Σ; in particular, 𝔭 + (xy) ≠ 𝔭, and x ∉ 𝔭. Therefore 𝔭 is prime ideal, which completes the proof that 𝔑 = 0.

Let 𝔭 be a prime ideal of B. Then B/𝔭 is an integral domain, algebraic over k, and hence is a field (by 3.32). Therefore 𝔭 is maximal. Let 𝔭_{1}, 𝔭_{2}, …, 𝔭_{r} be prime ideals of B. Since they are all maximal, they are relatively prime in pairs. Therefore the Chinese remainder theorem shows that

B/ ∩ 𝔭_{i} = ∏ B/𝔭_{i}  (*)

Note that

[B: k] ≥ [B/ ∩ 𝔭_{i} : k] = ∑[B/𝔭_{i}: k] ≥ r.

Therefore B has only finitely many prime ideals, say 𝔭_{1}, …, 𝔭_{g} where g ≤ [B: k], and ∩𝔭_{i} = 0. When we take r = g in (*) we find that

B = ∏_{i=1}^{g} B/𝔭_{i}.

For each i, B/𝔭_{i} is a field, and it is a finite extension of k. Because k is perfect, it is even a separable extension of k. Now we can apply (2.25) to deduce that disc((B/𝔭_{i})/k) ≠ 0, and we can apply the preceding lemma to deduce that disc(B/k) ≠ 0. □

We now prove the theorem. From the first lemma, we see that

disc(B/A) mod 𝔭 = disc((B/𝔭B)/(A/𝔭)),

and from the last lemma that disc((B/𝔭B)/(A/𝔭)) = 0 if and only B/𝔭B is not reduced. But B/𝔭B = ∏ B/𝔓^{e_{i}}, and ∏ B/𝔓^{e_{i}} is reduced if and only if each B/𝔓^{e_{i}} is reduced, and B/𝔓^{e_{i}} is reduced if and only if e_{i} = 1. □

Remark 3.41. (a) In fact there is a precise, but complicated, relation between the power of 𝔭 dividing Disc(B/A) and the extent to which 𝔭 ramifies in B. It implies for example that ord_{𝔭}(disc(B/A)) ≥ ∑ f_{i}(e_{i} − 1), and that equality holds if e_{i} is not divisible by the characteristic of A/𝔭. We may discuss this later.

(b) Let A be the ring of integers in a number field K, and let B be the integral closure of A in a finite extension L of K. It is possible to define disc(B/A) (as an ideal) without assuming B to be a free A-module. Let 𝔭 be an ideal in A, and let S = A − 𝔭. Then S^{−1}A = A_{𝔭} is principal, and so we can define Disc(S^{−1}B/S^{−1}A). It is a power (𝔭A_{𝔭})^{m(𝔭)} of 𝔭A_{𝔭}. Define

disc(B/A) = ∏ 𝔭^{m(𝔭)}.

The index m(𝔭) is nonzero for only finitely many 𝔭, and so this formula does define an ideal in A. Clearly this definition agrees with the usual one when B is a free A-module, and the above proof shows that a prime ideal 𝔭 ramifies in B if and only if it divides Disc(B/A).

Example 3.42. (For experts on Riemann surfaces.) Let X and Y be compact connected Riemann surfaces, and let α: Y → X be a nonconstant holomorphic mapping. Write M(X) and M(Y) for the fields of meromorphic functions on X and Y. The map f ↦ f ∘ α is an inclusion M(X) ↪ M(Y) which makes M(Y) into a field of finite degree over M(X); let m be this degree. Geometrically, the map is m: 1 except at a finite number of branch points.

Let P ∈ X and let O_{P} be the set of meromorphic functions on X that are holomorphic at P —it is the discrete valuation ring attached to the discrete valuation ord_{P}, and its maximal ideal is the set of meromorphic functions on X that are zero at P. Let B be the integral closure of O_{P} in M(Y). Let α^{−1}(P) = {Q_{1}, ..., Q_{g}} and let e_{i} be the number of sheets of Y over X that coincide at Q_{i}. Then 𝔭B = ∏ 𝔔_{i}^{e_{i}} where 𝔔_{i} is the prime ideal {f ∈ B | f(Q_{i}) = 0}.

Finding factorizations. The following result often makes it very easy to factor an ideal in an extension field. Again A is a Dedekind domain with field of fractions K, and B is the integral closure of A in a finite separable extension L of K.

Theorem 3.43. Suppose that B = A[α], and let f(X) be the minimum polynomial of α over K. Let 𝔭 be a prime ideal in A. Choose polynomials g_{1}(X), …, g_{r}(X) in A[X] which are distinct and irreducible modulo 𝔭, and such that f(X) ≡ ∏ g_{i}(X)^{e_{i}} modulo 𝔭. Then

𝔭B = ∏(𝔭, g_{i}(α))^{e_{i}}

is the factorization of 𝔭B into a product of powers of distinct prime ideals. Moreover, the residue field B/(𝔭, g_{i}) ≈ (A/𝔭)[X]/(g_{i}), and so the residue class degree f_{i} is equal to the degree of g_{i}.

Proof. Our assumption is that the map X ↦ α defines an isomorphism

A[X]/(f(X)) → B.

When we divide out by 𝔭 (better, tensor with A/𝔭), this becomes an isomorphism

k[X]/(f̄(X)) ⟶ B/𝔭B, X ↦ α.

where k = A/𝔭. The ring k[X]/(f̄) has maximal ideals (ḡ_{1}), ..., (ḡ_{r}), and ∏(ḡ_{i})^{e_{i}} = 0 (but no product with smaller exponents is zero). The ideal (ḡ_{i}) in k[X]/(f̄) corresponds to the ideal (g_{i}(α)) + 𝔭B in B/𝔭B, and this corresponds to the ideal 𝔓_{i} =_{df} (𝔭, g_{i}(α)) in B. Thus 𝔓_{1}, ..., 𝔓_{r} is the complete set of prime ideals containing 𝔭B, and hence is the complete set of prime divisors of 𝔭 (see 3.13). When we write 𝔭B = ∏ 𝔓_{i}^{e_{i}}, then the e_{i} are characterized by the fact that 𝔭B ⊃ ∏ 𝔓_{i}^{e_{i}}, but 𝔭B does not contain the product if any e_{i} is replaced with a smaller value. Thus it follows from the above (parenthetical) statement that e_{i} is the exponent of ḡ_{i} occurring in the factorization of f̄. □

Remark 3.44. When it applies the last theorem can be used to prove (3.36) and (3.37). For example, m = deg(f), and so the equation m = ∑ e_{i}f_{i} is simply the equation deg(f) = ∑ e_{i} · deg(g_{i}). Also, disc(B/A) = disc(f(X)), and this is divisible by 𝔭 if and only if f̄(X) has multiple factors (when regarded as an element of (A/𝔭)[X]), i.e., if and only if some e_{i} > 0.

Remark 3.45. The conclusion of the theorem holds for a particular prime 𝔭 of A under the following weaker hypothesis: disc(1, α, ..., α^{m−1}) = 𝔞·Disc(B/A) with 𝔞 an ideal of A not divisible by 𝔭. To prove this, first invert some elements to make 𝔞 the full ring.

Examples of factorizations. We use Theorem 3.43 to obtain some factorizations.

Example 3.46. Let m ≠ 1 be a square-free integer. We consider the factorization of prime integers in K = ℚ[\sqrt{m}]. Recall that disc(1, \sqrt{m}) = 4m, and that disc(O_{K}/ℤ) = disc(1, \sqrt{m}) if m ≡ 2, 3 mod 4, and that disc(O_{K}/ℤ) = disc(1, \sqrt{m})/4 if m ≡ 1 mod 4. In both cases, we can use the set \{1, \sqrt{m}\} to compute the factorization of an odd prime p (see 3.45). Note that (3.36) allows only three possible factorizations of (p) in O_{K}, namely

(p) = 𝔭^{2}:  (p) ramifes, e = 2, f = 1, g = 1;
(p) = 𝔭:  (p) stays prime, e = 1, f = 2, g = 1;
(p) = 𝔭_{1}𝔭_{2}:  (p) splits, e = 1, f = 1, g = 2.

One obtains the following result.

(i) If p| disc(O_{K}/ℤ), then (p) ramifies in O_{K}. (ii) For an odd prime p not dividing the m, we have

(p) is the product of two distinct ideals ⟺ m is a square mod p, i.e., (\frac{m}{p}) = 1;

(p) is a prime ideal in ℚ[\sqrt{m}] ⟺ m is not a square mod p, i.e., (\frac{m}{p}) = −1.

(iii) For the prime 2 when m ≡ 1 mod 4, we have (p) is the product of two distinct ideals ⟺ m ≡ 1 mod 8;

(p) is a prime ideal in ℚ[\sqrt{m}] ⟺ m ≡ 5 mod 8. To prove (iii), we must use the integral basis \{1, α\}, α = (1+\sqrt{m})/2. The minimum polynomial of α is X^{2} − X + (1 − m)/4. If m ≡ 1 mod 8, this factors as X^{2} + X = X(X +1) mod 2, and so (2) = (2, α)(2, 1+α). If m ≡ 5 mod 8, then X^{2} −X +(1− m)/4 ≡ X^{2} + X + 1 mod 2, which is irreducible, and so (2) = (2, 1 + α + α^{2}) = (2).

Example 3.47. We know (from Math 512) that ℤ[i], the Gaussian integers, is a principal ideal domain. I claim that the following conditions on an odd prime p are equivalent:

(a) p ≡ 1 mod 4;

(b) (p) splits in ℤ[i];

(c) there exist integers a and b such that 𝔭 = a^{2} + b^{2}. We know that (p) splits in ℤ[i] if and only if -1 is a square mod p, but this is so if and only if 𝔽_{p} contains a 4^{th} root of 1, i.e., if and only if the group 𝔽_{p}^{×} contains an element of order 4. As 𝔽_{p}^{×} is a cyclic group (see Math 594) of order p − 1, this is so if and only if 4|p − 1. Thus we have shown that (a) and (b) are equivalent.

Suppose (p) splits in ℤ[i], say (p) = 𝔭_{1}𝔭_{2}. Then 𝔭_{1} and 𝔭_{2} are principal, and if 𝔭_{1} = (a + ib) then 𝔭_{2} = (a − ib). Therefore a^{2} + b^{2} = p up to multiplication by a unit in ℤ[i]. But the only units in ℤ[i] are ±1, ±i, and so obviously a^{2} + b^{2} = p. Conversely, if p = a^{2} + b^{2} with a, b ∈ ℤ, then (p) = (a + ib)(a − ib).

[The fact that every prime of the form 4n+1 is a sum of two squares was stated as a theorem by Fermat in a letter in 1654. Euler, who was almost certainly unaware of Fermat’s letter, found a proof. For some history, and a discussion of algorithms for finding a and b, see Edwards p55.]

Remark 3.48. (a) From (3.43) and (3.44) we see that, for almost all p, factoring (p) in O_{K} amounts to factoring a polynomial f(X) modulo p into a product of powers of irreducible polynomials. Clearly, this can always be done, but may require a lot of hard work (but not much intelligence). Hence it can safely be left to the computer. In Maple, type:

Factors(f(X)) mod p; In Mathematica, type:

Factor[f(X), Modulus->p]

(b) In the next section, we shall show, not only that the class group of a number field is finite, but that it is generated by the prime ideals dividing a certain small set of prime numbers. Finding the class number therefore involves finding the prime ideal factors of these prime numbers, and the relations among them.

Example 3.49. Let α be a root of X^{3} + 10X + 1. Recall that the discriminant of the polynomial is -4027, and so the ring of integers in ℚ[α] is ℤ + ℤα + ℤα^{2}. There are the following factorizations:

2 (1 + X)(1 + X + X^{2})  (2) = (2, 1 + α)(2, 1 + α + α^{2})
3 (2 + X)(2 + X + X^{2})  (3) = (3, 2 + α)(3, 2 + α + α^{2})
5 (1 + X)(1 + 4X + X^{2})  (5) = (5, 1 + α)(5, 1 + 4α + α^{2})

7 (3 + X)(5 + 4X + X^{2}) 11 (6 + X)(2 + 5X + X^{2})

13 1 + 10X + X^{3}  (13) = (13, 1 + 10α + α^{2}) = (13)
17 1 + 10X + X^{3}  (17) =prime ideal.
4027 (2215 + X)^{2}(3624 + X) (4027) = (4027, 2215 + α)^{2}(4027, 3624 + α).

Example 3.50. Let α be a root of X^{3} − 8X + 15. Here again, the discriminant of the polynomial is -4027, and so the ring of integers in ℚ[α] is ℤ + ℤα + ℤα^{2}. There are the following factorizations:

2 (1 + X)(1 + X + X^{2})  (2) = (2, 1 + α)(2, 1 + α + α^{2})
3 X(1 + X^{2})  (3) = (3, α)(3, 1 + α^{2})

5 X(2 + X^{2}) 7 (5 + X)(3 + 2X + X^{2}) 11 (1 + X)(4 + 10X + X^{2}) 13 2 + 5X + X^{3}

17 (4 + X)(6 + X)(7 + X)  (17) = (17, 4 + α)(17, 6 + α)(17, 7 + α)

4027 (509 + X)(1759 + X)^{2}.

On comparing the factorizations of (17) in the fields in the last two examples, we see that the fields can’t be isomorphic.

Remark 3.51. When K is a number field, it is interesting to have a description of the set of prime numbers that split in K. For K = ℚ[\sqrt{m}], this is the set of p for which (\frac{m}{p}) = 1, and we shall see later that the quadratic reciprocity law gives a good description of the set. For any abelian Galois extension K of ℚ, class field theory gives a similarly good description, but for an arbitrary extension very little is known about what sets can occur. There is a deep theorem (in class field theory) that says that two Galois extensions K and K′ of ℚ are isomorphic if and only if S(K) = S(K′). Moreover, this can be made into an effective procedure for determining when fields are isomorphic. See Math 776.

Example 3.52. In (2.38), we saw that f(X) = X^{5} − X − 1 is irreducible in ℚ[X], and that its discriminant is 19 · 151, which is square-free, and so, if α is a root of f(X), then ℤ[α] is the ring of integers in ℚ[α]. We have 19 (6 + X)^{2}(10 + 13X + 17X^{2} + X^{3})

(19) = (19, 6 + α)^{2}(19, 10 + 13α + 17α^{2} + α^{3})

151 (9 + X)(39 + X)^{2} …  (151) = (151, 9 + α)(151, 39 + α)^{2} …

4027 (1261 + X)(2592 + X)(790 + 3499X + 174X^{2} + X^{3}).

Thus (19) and (151) are ramified in ℚ[α], and 4027 isn’t, which is what Theorem 3.37 predicts.

Example 3.53. According to Maple,

1 + X + X^{2} + X^{3} + X^{4} ≡ (4 + X)^{4} mod 5

Why is this obvious?

Eisenstein extensions. Recall that Eisenstein’s criterion says that a polynomial

X^{m} + a_{1}X^{m−1} + ⋯ + a_{m},

such that a_{i} ∈ ℤ, p|a_{i} all i, and p^{2} does not divide a_{m}, is irreducible in ℚ[X]. We will improve this result, but first we need to make two observations about discrete valuations.

Let A be a Dedekind domain, and let B be its integral closure in a finite extension L of its field of fractions K. Let 𝔭 be a prime ideal of A and let 𝔓 be an ideal of B dividing 𝔭, say 𝔭B = 𝔓^{e} · · ·. Write ord_{𝔭} and ord_{𝔓} for the normalized valuations on K and L defined by 𝔭 and 𝔓. Then

ord_{𝔓} |K = e · ord_{𝔭}

because, if (a) = 𝔭^{m} ⋯ in A, then (a) = 𝔓^{me} ⋯ in B.

Next note that if

a_{1} + ⋯ + a_{n} = 0

then the minimum value of ord(a_{i}) must be attained for at least two is. Suppose not, say ord(a_{1}) < ord(a_{i}) for all i > 1. Then

ord(a_{2} + a_{3} + ... + a_{m}) ≥ min(ord(a_{2}) + ord(a_{3} + ... + a_{m})) ≥ … ≥ min(ord(a_{i})),

and −a_{1} = ∑ a_{i} implies ord(a_{1}) = ord(∑ a_{i}), which is a contradiction. Let A be a Dedekind domain and let 𝔭 be a prime ideal in A. A polynomial

X^{m} + a_{1}X^{m−1} + … + a_{m}, a_{i} ∈ A,

is said to be Eisenstein relative to 𝔭 if

ord_{𝔭}(a_{i}) > 0, …, ord_{𝔭}(a_{m−1}) > 0, ord_{𝔭}(a_{m}) = 1.

Proposition 3.54. Let f(X) ∈ A[X] be an Eisenstein polynomial with respect to 𝔭. Then f(X) is irreducible, and if α is a root of f(X), then 𝔭 is totally ramified in K[α]; in fact 𝔭B = 𝔓^{m} with 𝔓 = (𝔭, α) and m = deg(f).

Proof. Let L = K[α]—we have [L: K] ≤ m. Let 𝔓 be a prime ideal dividing 𝔭, with ramification index e say. Consider

α^{m} + a_{1}α^{m−1} + ⋯ + a_{m} = 0.

Because f(X) is Eisenstein,

ord(α^{m}) = m · ord(α); ord(a_{i}α^{m−i}) ≥ (m − i) · ord(α) + e; ord(a_{m}) = e.

If ord(α) = 0, then the minimum value of ord is taken for a single term, namely α^{m}. This is impossible, and so ord(α) ≥ 1, and ord(a_{i}α^{m−i}) > ord(a_{m}) = e for i = 1, ..., m. From the remark preceding the proposition, we must have m · ord(α) = e. Then

m · ord(α) = e ≤ [K[α] : K] ≤ m,

and we must have equalities throughout: ord(α) = 1, [K(α): K] = m = e. □

§4 The Finiteness of the Class Number

In this section we prove the first main theorem of the course: the class number of a number field is finite. The method of proof is effective: it gives an algorithm for computing the class group.

Norms of ideals. Let A be a Dedekind domain with field of fractions K, and let B be the integral closure of A in a finite separable extension L. We want to define a homomorphism Nm: Id(B) → Id(A) which is compatible with taking norms of elements, i.e., such that the following diagram commutes:

L^{×} ⟶ Id(B)
↓^{Nm}  ↓^{Nm}
K^{×} ⟶ Id(A).

(*)

Because Id(B) is the free abelian group on the set of prime ideals, we only have to define Nm(𝔓) for 𝔓 prime.

Let 𝔭 be a prime ideal A, and factor 𝔭B = ∏ 𝔓_{i}^{e_{i}}. If 𝔭 is principal, say 𝔭 = (π), then we should have

Nm(𝔭B) = Nm(π · B) = Nm(π) · A = (π^{m}) = 𝔭^{m}, m = [L: K].

Also, because Nm is to be a homomorphism, we should have

Nm(𝔭B) = Nm(∏ 𝔓_{i}^{e_{i}}) = ∏ Nm(𝔓_{i})^{e_{i}}.

On comparing these two formulas, and recalling (3.36) that m = ∑ e_{i}f_{i}, we see that we should define Nm(𝔓_{i}) = 𝔭^{f_{i}}. We take this as our definition:

Nm(𝔓) = 𝔭^{f(𝔓/𝔭)} where 𝔭 = 𝔓 ∩ A and f(𝔓/𝔭) = [B/𝔓: A/𝔭].

To avoid confusion, I sometimes use N to denote norms of ideals.

If we have a tower of fields M ⊃ L ⊃ K, then

N_{L/K}(N_{M/L}𝔄) = N_{M/K}𝔄

because f(𝔔/𝔓) · f(𝔓/𝔭) = f(𝔔/𝔭), i.e., [C/𝔔: B/𝔓] · [B/𝔓: A/𝔭] = [C/𝔔: A/𝔭] where C ⊃ B ⊃ A are the integral closures of A in M, L, and K respectively.

Proposition 4.1. Let A ⊂ B and K ⊂ L be as above.

(a) For any nonzero ideal 𝔞 ⊂ A, N (𝔞B) = 𝔞^{m}, where m = [L : K].

(b) Suppose L is Galois over K. Let 𝔓 be a nonzero prime ideal of B and let 𝔭 = 𝔓 ∩ A. Write 𝔭 · B = (𝔓_{1} ⋯ 𝔓_{g})^{e} (cf. 3.36). Then

N 𝔓 · B = (𝔓_{1} ⋯ 𝔓_{g})^{ef} = ∏_{σ∈Gal(L/K)} σ𝔓.

(c) For any nonzero element β ∈ B, Nm(β)·A = Nm(β ·B) (i.e., (*) commutes).

Proof. (a) It suffices to prove this for a prime ideal 𝔭, and for such an ideal we have that

N (𝔭B) = N (∏ 𝔓_{i}^{e_{i}}) =_{df} 𝔭^{∑ e_{i}f_{i}} = 𝔭^{m} (by 3.36).

(b) Since N 𝔓_{i} = 𝔭^{f} for each i, the first equality is obvious. In the course of the proof of (3.36), we showed that Gal(L/K) acts transitively on the set {𝔓_{1}, ..., 𝔓_{g}}, and it follows that each 𝔓_{i} occurs \frac{m}{g} = ef times in the family \{σ𝔓 | σ ∈ Gal(L/K)\}.

(c) Suppose first that L is Galois over K, and let β · B = 𝔟. The map 𝔞 ↦ 𝔞 · B: Id(A) → Id(B) is injective (remember they are free abelian groups on the nonzero prime ideals), and so it suffices to show that Nm(β) · B = Nm(𝔟) · B. But

Nm(𝔟) · B \begin{matrix}(b) \\ = \end{matrix} ∏ σ𝔟 = ∏(σβ · B) = (∏ σβ) · B = Nm(β) · B

as required.

In the general case, let E be a finite Galois extension of K containing L, and let d = [E: L]. Let C be the integral closure of B in E. From (a), the Galois case, and the transitivity of N we have that

N_{L/K}(β · B)^{d} = N_{E/K}(β · C) = Nm_{E/K}(β) · A = Nm_{L/K}(β)^{d} · A. As the group of ideals Id(A) is torsion-free, this implies that N_{L/K}(β · B) = Nm_{L/K}(β) · A. □

Let 𝔞 be a nonzero ideal in the ring of integers O_{K} of a number field K. Then 𝔞 is of finite index in O_{K}, and we let ℕ𝔞 be this index:

ℕ𝔞 = (O_{K}: 𝔞).

Proposition 4.2. Let O_{K} be the ring of integers in a number field K. (a) For any ideal 𝔞 in O_{K}, N (𝔞) = (ℕ(𝔞)); therefore ℕ(𝔞𝔟) = ℕ(𝔞)ℕ(𝔟).

(b) Let 𝔟 ⊂ 𝔞 be fractional ideals in K; then (𝔞: 𝔟) = ℕ(𝔞^{−1}𝔟).

Proof. (a) Write 𝔞 = ∏ 𝔭_{i}^{r_{i}}, and let f_{i} = f(𝔭_{i}/p_{i}); then Nm(𝔭_{i}) = (p_{i})^{f_{i}}. From the Chinese remainder theorem, O_{K}/𝔞 ≈ ∏ O_{K}/𝔭_{i}^{r_{i}}, and so (O_{K}: 𝔞) ≈ ∏(O_{K}: 𝔭_{i}^{r_{i}}). In the course of the proof of (3.36), we showed that O_{K}/𝔭_{i}^{r_{i}} is a vector space of dimension f_{i}r_{i} over 𝔽_{p_{i}}, and so (O_{K}: 𝔭_{i}^{r_{i}}) = p_{i}^{f_{i}r_{i}}. On taking the product over i, we find that (O_{K}: 𝔞) = ∏(p^{f_{i}r_{i}}) = N 𝔞. When we identify the set of nonzero ideals in ℤ with the set of positive integers, then N becomes identified with ℕ, and so the multiplicativity of ℕ follows from that of N.

(b) For any nonzero d ∈ K, x ↦ dx: K → K is an additive isomorphism, and so (d𝔞: d𝔟) = (𝔞: 𝔟). Since, (d𝔞)(d𝔟)^{−1} = 𝔞𝔟^{−1}, we may suppose that 𝔞 and 𝔟 are integral ideals. The required formula then follows from (a) and the formulas

(O_{K}: 𝔞)(𝔞: 𝔟) = (O_{K} : 𝔟)

and

ℕ(𝔞) · ℕ(𝔞^{−1}𝔟) = ℕ(𝔟).

Statement of the main theorem and its consequences. We now state the main theorem of this section and discuss some of its consequences.

Theorem 4.3. Let K be an extension of degree n of ℚ, and let Δ_{K} be the discriminant of K. Let 2s be the number of nonreal complex embeddings of K. Then there exists a set of representatives for the ideal class group of K consisting of integral ideals 𝔞 with

ℕ(𝔞) ≤ \frac{n!}{n^{n}} (\frac{4}{π} )^{s} |Δ_{K}|^{\frac{1}{2}} .

The number on the right is called the Minkowski bound—we sometimes denote it by B_{K}. The term C_{K} = \frac{n!}{n^{n}} (\frac{4}{π} )^{s} is called the Minkowski constant. It takes the following values:

\begin{matrix}N & r & s & C \\ 2 & 0 & 1 & 0.636 \\ 2 & 2 & 0 & 0.500 \\ 3 & 1 & 1 & 0.283 \\ 3 & 3 & 0 & 0.222 \\ 4 & 0 & 2 & 0.152 \\ 4 & 2 & 1 & 0.119 \\ 4 & 4 & 0 & 0.094 \\ 5 & 1 & 2 & 0.062 \\ 5 & 3 & 1 & 0.049 \\ 5 & 5 & 0 & 0.038 \\ … & … & … & … \\ 100 & 100 & 0 & 0.93 × 10^{−42} \end{matrix}

Here r is the number of real embeddings of K. We have

K ⊗_{ℚ} ℝ ≈ ℝ^{r} × ℂ^{s},

and, if K = ℚ[α] and f(X) is the minimum polynomial of α, then r is the number of real roots of f(X) and 2s is the number of its nonreal roots. To see that these descriptions of r and s are agree, apply (1.13).

Before proving (4.3), we give some applications and examples.

Theorem 4.4. The class number of K is finite.

Proof. It suffices to show that, for any number M > 0, there are only finitely many integral ideals 𝔞 in O_{K} such that ℕ(𝔞) < M. Write 𝔞 = ∏ 𝔓_{i}^{r_{i}}. If 𝔓_{i}|p_{i}, then ℕ(𝔞) = ∏ p_{i}^{r_{i}f_{i}}. As ℕ(𝔞) < M, p_{i}^{r_{i}} < M, and so there are only finitely many possibilities for the p_{i} (and hence for the 𝔓_{i}), and only finitely many possibilities for the exponent r_{i}, each i. □

Let S be the set of integral ideals in K with norm < B_{K}. Then S is a finite set, and Cl(O_{K}) = S/ ∼, where 𝔞 ∼ 𝔟 if one ideal is the product of the other with a principal (fractional) ideal. There is an algorithm for finding S, and an algorithm for deciding whether 𝔞 ∼ 𝔟, and so there is an algorithm for finding Cl(O_{K}) (the group, not just it’s order). To find S, find the prime ideal factors of enough prime numbers, and form some of their products. To decide whether 𝔞 ∼ 𝔟, one has to decide whether 𝔠 = 𝔞𝔟^{−1} is principal. From (4.2b) we know that, for γ ∈ 𝔠,

𝔠 = (γ) ⟺ ℕ𝔠 = | Nm γ|

and so we have to solve the equation:

Nm γ = constant.

When we express γ in terms of an integral basis, this becomes a (very special) type of diophantine equation. For a description of an algorithm for finding Cl(O_{K}), see P&Z p424

Example 4.5. Let K = ℚ[i]. The condition in the theorem is that ℕ(𝔞) ≤ \frac{2}{4} \frac{4}{π} 2 < 1.27. There are no such ideals other than ℤ[i], and so ℤ[i] is a principal ideal domain. (Of course, the elementary proof of this shows more, namely, that ℤ[i] is a Euclidean domain. Even for rings of integers in number fields, it is not true that all principal ideal domains are Euclidean domains. For example, ℚ[\sqrt{−19}] has class number 1, but its ring of integers is not a Euclidean domain.)

Example 4.6. Let K = ℚ[\sqrt{−5}]. Here ℕ(𝔞) ≤ 0.63 × \sqrt{20}< 3. Any ideal satisfying this must divide (2). In fact, (2) = 𝔭^{2} where 𝔭 = (2, 1+\sqrt{−5}), and ℕ𝔭^{2} = ℕ(2) = 4, and so ℕ𝔭 = 2. The ideals O_{K} and 𝔭 form a set of representatives for Cl(ℤ[\sqrt{−5}]). The ideal 𝔭 can’t be principal because there does not exist an element α = m+n\sqrt{−5} such that Nm(α) = m^{2} + 5n^{2} = 2, and so Cl(ℤ[\sqrt{−5}]) has order 2.

Example 4.7. Let K be a cubic field with discriminant < 0. Since the sign of Δ is (−1)^{s}, and [K: ℚ] = r + 2s, we have s = 1, r = 1. The Minkowski bound is

B < .283|Δ|^{\frac{1}{2}} .

For |Δ| ≤ 49, B < 2, and so for cubic fields with −49 ≤ Δ < 0, the class number h = 1. For example, this is true for the number fields with discriminants -27 and -31 discussed earlier (see 2.35, 2.36).

For the field generated by a root of X^{3} + 10X + 1, the discriminant is -4027, and the Minkowski bound is < 18. Recall from (3.49) that

(2) = (2, 1 + α)(2, 1 + α + α^{2}).

Let 𝔭 = (2, 1 + α)—its norm is 2. One can show that it generates the class group, and that it has order 6 in the class group, i.e., 𝔭^{6} but no smaller power is principal. Hence the class group is cyclic of order 6. (The proof takes quite a bit of hard work if you do it by hand—see Artin, Theory of Algebraic Numbers, p160-162, 170-172.)

An extension L of a number field K is said to be unramified over K if no prime ideal of O_{K} ramifies in O_{L}.

Theorem 4.8. There does not exist an unramified extension of ℚ.

Proof. Let K be a finite extension of ℚ. Since ℕ(𝔞) is a positive integer, we have

|Δ|^{\frac{1}{2}} ≥ \frac{n^{n}}{n!} (\frac{π}{4} )^{s} ≥ \frac{n^{n}}{n!} (\frac{π}{4} )^{n/2} .

Let a_{n} = rhs. Then a_{2} > 1, and \frac{a_{n+1}}{a_{n}} = (\frac{π}{4} )^{\frac{1}{2}} (1 + \frac{1}{n})^{n} > 1, and so the sequence a_{n} is monotonically increasing. Hence the discriminant of K has absolute value > 1, and we know from (3.37) that any prime dividing the discriminant ramifies. □

We can now prove that there is no irreducible monic polynomial f(X) ∈ ℤ[X] of degree > 1 with discriminant ±1. Let f(X) be such a polynomial, and let α be a root of f(X). Then disc(ℤ[α]/ℤ) = ±1, and so ℤ[α] is the ring of integers in K =_{df} ℚ[α] and disc(O_{K}/ℤ) = ±1, which we have just seen can’t happen.

Remark 4.9. There may exist unramified extensions of number fields other than ℚ. In fact, class field theory says that the maximal abelian unramified extension of K (called the Hilbert class field of K) has Galois group canonically isomorphic to Cl(O_{K}). For example, the theory says that ℚ[\sqrt{−5}] has an unramified extension of degree 2, and one verifies that ℚ[\sqrt{−1}, \sqrt{−5}] is unramified over ℚ[\sqrt{−5}].

Aside 4.10. Let K_{1} be a number field with class number h_{K_{1}} > 1. As we just mentioned, the Hilbert class field of K_{1} is an abelian unramified extension K_{2} of K_{1} with Gal(K_{2}/K_{1}) ≈ Cl(K_{1}). Let K_{3} be the Hilbert class field of K_{2}, and so on. In this way, we obtain a tower of fields,

K_{1} ⊂ K_{2} ⊂ K_{3} ⊂ …

It was a famous question (class field tower problem) to decide whether this tower can be infinite, or must always terminate with a field of class number 1 after a finite number of steps. It was shown by Golod and Shafarevich in the early 60s that the tower is frequently infinite. (See the article by Roquette in Cassels-Fröhlich.)

Example 4.11. Let α be a root of f(X) = X^{5} − X + 1. As we saw in (2.38) that f(X) is irreducible and its discriminant is 19 × 151, and so the ring of integers of K =_{df} ℚ[α] is ℤ[α].

According to Theorem 4.3, every class of ideals for ℚ[α] contains an integral ideal 𝔞 with ℕ(𝔞) < 0.062 × \sqrt{19 × 151} = 3.3 < 4. If 𝔭 is a prime ideal with ℕ(𝔭) = 2, then f(𝔭/(2)) = 1, and f(X) must have a root mod 2, but it doesn’t, and so 𝔭 can’t exist. Similarly, there is no prime ideal 𝔭 with ℕ(𝔭) = 3, and so O_{K} is a principal ideal domain!

The Galois group of the splitting field M of f(X) is S_{5} (later we shall see how to find Galois groups; for the moment type “galois(X^{5} −X +1);” in Maple), and hence [M: ℚ] = 120. It is possible to show that M is unramified over ℚ[\sqrt{19 × 151}].

Lattices. Let V be a vector space of dimension n over ℝ. A lattice Λ in ℝ is a subgroup of the form

Λ = ℤe_{1} + ⋯ + ℤe_{r}

with e_{1}, ..., e_{r} linearly independent elements of V. Thus a lattice is the free abelian subgroup of V generated by elements of V that are linearly independent over ℝ. When r = n, the lattice is said to be full. At the opposite extreme, Λ = {0} is a lattice (generated by the empty set of elements). In terms of tensor products, one can say that a full lattice in V is a subgroup Λ of V such that

∑ r_{i} ⊗ x_{i} ↦ ∑ r_{i}x_{i}, ℝ ⊗_{ℤ} Λ ⟶ V,

is an isomorphism.

Nonexample 4.12. The subgroup ℤ + ℤπ, π = 3.14159 …, is a free abelian group (of rank 2) in ℝ, but it is not a lattice.

We shall need another criterion for a subgroup Λ of V to be a lattice. The choice of a basis for V determines an isomorphism of V with ℝ^{n}, and hence a topology on V; the topology is independent of the basis, because any linear automorphism ℝ^{n} is a homeomorphism. A subgroup Λ of V is said to be discrete if it a discrete in the induced topology. Recall that a topological space is discrete if its points (hence all subsets) are open. Thus to say that Λ is discrete means that every point α of Λ has a neighbourhood U in V such that U ∩ V = {α}.

Lemma 4.13. The following conditions on a subgroup Λ of a finite-dimensional real vector space V are equivalent:

(a) Λ is a discrete subgroup;

(b) there is an open subset U of V such that U ∩ Λ = {0};

(c) each compact subset of V intersects Λ in a finite set;

(d) each bounded subset of V intersects Λ in a finite set.

Proof. (a) ⟺ (b). Obviously (a) implies (b). For the converse, note that the translation map x ↦ α + x: V → V is a homeomorphism, and that therefore if U is a neighbourhood of 0 such that U ∩ Λ = {0}, then α + U is a neighbourhood of α such that (α + U) ∩ Λ = {α}.

(a) ⟹ (c). Condition (a) says that Λ is a discrete space for the induced topology. Hence, if C is compact, then C ∩Λ is both discrete and compact, and therefore must be finite.

(c) ⟹ (d). The closure of a bounded set in ℝ^{n} (hence in V) is compact, and so this is obvious.

(d) ⟹ (b). Let U be a bounded open neighbourhood of 0. Then S = U ∩Λ−{0} is finite and hence closed, and so U − S is an open neighbourhood of {0} such that (U − S) ∩ Λ = {0}. □

Proposition 4.14. A subgroup Λ of V is a lattice if and only if it is discrete.

Proof. Clearly, a lattice is discrete. For the converse, let Λ be a discrete subgroup of V, and let e_{1}, ..., e_{r} be a maximal ℝ-linearly independent subset of Λ. We shall use induction on r.

If r = 0, Λ = 0, and there is nothing to prove.

If r = 1, then every α ∈ Λ can be written α = ae_{1}, some c ∈ ℝ. Because Λ is discrete, {ae_{1} | |a| < M} is finite, and so there is an f_{1} ∈ Λ such that, when we write f_{1} = ae_{1}, a attains its minimum value > 0. I claim Λ = ℤf_{1}. If α ∈ Λ, α ∉ ℤf_{1}, then we can find an integer m such that α − mf_{1} = bf_{1} with 0 < b < 1; but then (α − mf_{1}) = bf_{1} = abe_{1}, and 0 < ab < a, which contradicts our choice of f_{1}.

Let Λ′ = Λ∩(ℝe_{1} +⋯+ℝe_{r−1}). Clearly this is a discrete subgroup of the vector space V′ =_{df} ℝe_{1} + ⋯ + ℝe_{r−1} and so, by induction, Λ′ = ℤf_{1} + ⋯ + ℤf_{r−1} for some f_{i} that are linearly independent over ℝ (and hence also form a basis for V′). Every α ∈ Λ can be written uniquely

α = a_{1}f_{1} + ⋯ + a_{r−1}f_{r−1} + ae_{r}, a_{i}, a ∈ ℝ.

Let φ: Λ → ℝ be the map α ↦ a, and let Λ′′ = Im(φ). Note that a is also the image of

(a_{1} − [a_{1}])f_{1} + ⋯ + (a_{r−1} − [a_{r−1}])f_{r−1} + ae_{r}, [∗] = integer part,

and so each element a ∈ Λ′′ in a bounded set, say with 0 ≤ |a| < M, is the image of an element of Λ in a bounded set,

0 ≤ a_{i} < 1, i = 1, …, r − 1, |a| < M.

Thus there are only finitely many such as, and so Λ′′ is a lattice in ℝ, say Λ′′ = ℤ · φ(f_{r}), f_{r} ∈ Λ.

Let α ∈ Λ. Then φ(α) = aφ(f_{r}) for some a ∈ ℤ, and φ(α − af_{r}) = 0. Therefore α − af_{r} ∈ Λ′, and so it can be written

α − af_{r} = a_{1}f_{1} + ⋯ + a_{r−1}f_{r−1}, a_{i} ∈ ℤ.

Hence

α = a_{1}f_{1} + ⋯ + a_{r−1}f_{r−1} + af_{r}, a_{i}, a ∈ ℤ,

which proves that Λ = ∑ ℤf_{i}. □

Let V be a real vector space of dimension n, and let Λ be a full lattice in V, say Λ = ∑ ℤe_{i}. For any λ ∈ Λ, let

D = {λ_{0} + ∑ a_{i}e_{i} | 0 ≤ a_{i} < 1}.

Such a set is called a fundamental parallelopiped for Λ. Clearly ℝ^{n} is the disjoint union of all these sets.

Remark 4.15. (a) For a fundamental parallelopiped D of a full lattice

Λ = ℤf_{1} + ⋯ + ℤf_{n}

in ℝ^{n},

μ(D) = | det(f_{1}, ⋯, f_{n})|.

(See any good book on calculus.) If also

Λ = ℤf′_{1} + ℤf′_{2} + ⋯ + ℤf′_{n},

then the determinant of the matrix relating {f_{i}} and {f′_{i}} has determinant ±1.

(b) If Λ ⊃ Λ′ are two full lattices ℝ^{n}, then a fundamental parallelopiped D of Λ is a disjoint union of (Λ: Λ′) fundamental parallelopipeds D′ of Λ′. (To see this, choose bases {e_{i}} and {f_{i}} of Λ and Λ′ such that f_{i} = m_{i}e_{i}, m_{i} a positive integer.) Hence

\frac{μ(D′)}{μ(D)} = (Λ: Λ′).  (*)

As we noted above, the choice of a basis for V determines an isomorphism V ≈ ℝ^{n}, and hence a measure on μ on V. This measure is translation invariant (because the Lebesgue measure on ℝ^{n} is translation invariant), and well-defined up to multiplication by a nonzero constant (depending on the choice of the basis)^{7}. Thus the ratio of the measures of two sets is well-defined, and the equation (*) holds two full lattices Λ ⊃ Λ′ in V.

Theorem 4.16. Let D_{0} be a fundamental parallelopiped for a full lattice in V, and let S be a measurable subset in V. If μ(S) > μ(D_{0}), then S contains distinct points α and β such that β − α ∈ Λ.

Proof. The set S ∩ D is measurable for all fundamental parallelopipeds D, and

μ(S) = ∑ μ(S ∩ D) (sum over D).

For each D, a (unique) translate of S ∩ D by an element of Λ will be a subset of D_{0}. Since μ(S) > μ(D_{0}), at least two of these sets will overlap, i.e., there exist elements α, β ∈ S such that

α − λ = β − λ′, some λ, λ′ ∈ Λ.

Then β − α ∈ Λ. □

Remark 4.17. In the language of differential geometry, the theorem can be given a more geometric statement. Let M = V/Λ; it is an n-dimensional torus. The measure μ on V defines a measure on M for which M has measure μ(M) = μ(D). The theorem says that if μ(S) > μ(M), then the restriction of the quotient map V → M to S can’t be injective.

7The experts will recognize μ as being a Haar measure on V.

Let T be a set such that

α,β ∈ T ⟹ \frac{1}{2}(α − β) ∈ T,  (*)

and let S = \frac{1}{2}T. Then T contains the difference of any two points of S, and so T will contain a point of Λ other than the origin whenever

μ(D) < μ(\frac{1}{2}T) = 2^{−n}μ(T),

i.e., whenever

μ(T) > 2^{n}μ(D).

We say that a set T is convex if, with any two points, it contains the line joining the two points, and that T is symmetric in the origin if α ∈ T implies −α ∈ T. A convex set, symmetric in the origin, obviously satisfies (*), and so it will contain a point of Λ \ {0} if its volume is greater than 2^{n}μ(D).

Theorem 4.18. (Minkowski’s theorem) Let T be a subset of V that is compact, convex, and symmetric in the origin. If

μ(T) ≥ 2^{n}μ(D)

then T contains a point of the lattice other than the origin.

Proof. Replace T with (1+ε)T, ε > 0. Then μ((1+ε)T) = (1+ε)^{n}μ(T) > 2^{n}μ(D), and so (1 + ε)T contains a point of Λ other than the origin (see the preceding remark). It will contain only finitely many such points because Λ is discrete and (1 + ε)T is compact. Because T is closed

T = ∩_{ε>0}(1 + ε)T.

If none of the points of Λ ∩ (1 + ε)T is in T, we will be able to shrink (1 + ε)T (keeping ε > 0) so that it contains no point of Λ other than the origin—which is a contradiction. □

Remark 4.19. Theorem 4.18 was discovered by Minkowski in 1896. Although it is almost trivial to prove, it has lots of nontrivial consequences, and was the starting point for the branch of number theory (now almost defunct) called the “geometry of numbers”. We give one immediate application of it to prove that every positive integer is a sum of four squares of integers.

From the identity

(a^{2} + b^{2} + c^{2} + d^{2})(A^{2}+B^{2} + C^{2} + D^{2})
= (aA − bB − cC − dD)^{2} + (aB + bA + cD − dC)^{2}
+ (aC − bD + cA + dB)^{2} + (aD + bC − cB + dA)^{2},

we see that it suffices to prove that a prime p is a sum of four squares.

Since

2 = 1^{2} + 1^{2} + 0^{2} + 0^{2},

we can suppose that p is odd. I claim that the congruence

m^{2} + n^{2} + 1 ≡ 0 mod p

has a solution in ℤ. As m runs through 0, 1, …, p − 1, m^{2} takes exactly (p + 1)/2 distinct values modulo p, and similarly for −1 − n^{2}. For the congruence to have no solution, all these values, p + 1 in total, must be distinct, but this is impossible.

Fix a solution m, n to the congruence, and consider the lattice Λ ⊂ ℤ^{4} consisting of (a, b, c, d) such that

c ≡ ma + nb, d ≡ mb − na mod p.

Then ℤ^{4} ⊃ Λ ⊃ pℤ^{4} and Λ/pℤ^{4} is a 2-dimensional subspace of 𝔽_{p}^{4} (the a and b can be arbitrary mod p, but then c and d are determined). Hence Λ has index p^{2} in ℤ^{4}, and so the volume of a fundamental parallelopiped is p^{2}. Let T be a closed ball of radius r centered at the origin. Then T has volume π^{2}r^{4}/2, and so if we choose r^{2} > 1.9p say, then

μ(T) > 16μ(D).

According to Minkowski’s theorem, there is a point (a, b, c, d) ∈ (Λ \ {0}) ∩ T. Because (a, b, c, d) ∈ Λ,

a^{2} + b^{2} + c^{2} + d^{2} ≡ a^{2}(1 + m^{2} + n^{2}) + b^{2}(1 + m^{2} + n^{2}) ≡ 0 mod p,

and because (a, b, c, d) ∈ T,

a^{2} + b^{2} + c^{2} + d^{2} < 2p.

As a^{2} + b^{2} + c^{2} + d^{2} is a positive integer, these conditions imply that it equals p.

This result was stated by Fermat. Euler tried to prove it over a period of 40 years, and Lagrange succeeded in 1770.

Some calculus. Let V be a finite-dimensional real vector space. A norm on V is a function ∥ · ∥: V → ℝ such that (4.20.1) for all x ∈ V, ∥x∥ ≥ 0, and ∥x∥ = 0 ⟺ x = 0; (4.20.2) for r ∈ ℝ and x ∈ V, ∥rx∥ = |r|∥x∥; (4.20.3) (triangle law) for x, y ∈ V, ∥x + y∥ ≤ ∥x∥ + ∥y∥. Let V = ℝ^{r} × ℂ^{s}—it is a real vector space of dimension n = r + 2s. Define a

norm on V by

∥x∥ = ∑_{i=1}^{r} |x_{i}| + 2 ∑_{i=r+1}^{s} |z_{i}|

if x = (x_{1}, ..., x_{r}, z_{r+1}, ..., z_{r+s}).

Lemma 4.21. For any real number t > 0, let

X(t) = {x ∈ V | ∥x∥ ≤ t}.

Then

μ(X(t)) = 2^{r}(π/2)^{s}t^{n}/n!.

Proof. Since X(t) is symmetric with respect to the r real axes, we have

μ(X(t)) = 2^{r} · μ(Y (t))

where Y (t) = {x | ∥x∥ ≤ t, x_{1}, ..., x_{r} ≥ 0}. For the complex variables, we make the change of variable

z_{j} = x_{j} + iy_{j} = \frac{1}{2}ρ_{j}(cos θ_{j} + i sin θ_{j}).

The Jacobian of this change of variables is ρ_{j}/4. After integrating over the θ_{j}, for 0 ≤ θ_{j} ≤ 2π, we find that

μ(X(t)) = 2^{r} · 4^{−s} · (2π)^{s} ∫_{Z} ρ_{r+1} ⋯ ρ_{n}dx_{1} ⋯ dx_{r}dρ_{r+1} ⋯ dρ_{n}

where

Z = {(x, ρ) ∈ ℝ^{r+s} | x_{i}, ρ_{i} ≥ 0, ∑ x_{i} + ∑ ρ_{i} ≤ t}.

The result now follows from the next lemma by taking: m = r+s; a_{i} = 0, 1 ≤ i ≤ r; a_{i} = 1, r + 1 ≤ i ≤ m; for then

μ(X(t)) = 2^{r} · 4^{−s} · (2π)^{s} · t^{n}/n!

as required.

Lemma 4.22. For a_{i} > 0 ∈ ℝ, let

I(a_{1}, ..., a_{m}, t) = ∫_{Z(t)} x_{1}^{a_{1}} ⋯ x_{m}^{a_{m}}dx_{1} ⋯ dx_{m},

where Z(t) = {x ∈ ℝ^{m} | x_{i} ≥ 0, ∑ x_{i} ≤ t}. Then

I(a_{1}, …, a_{m}; t) = t^{∑ a_{i}+m} · \frac{Γ(a_{1} + 1) ⋯ Γ(a_{m} + 1)}{Γ(a_{1} + ⋯ + a_{m} + m + 1)}.

Proof. Recall that, by definition, (Widder, Chapter 11),

Γ(x) = ∫_{0+}^{∞} e^{−t}t^{x−1}dt.

It takes the value Γ(n) = (n − 1)! for n a nonnegative integer.

By making the change of variables x′_{i} = tx_{i} in I, we see that

I(a_{1}, …, a_{m}; t) = t^{∑ a_{i}+m}I(a_{1}, …, a_{m}; 1).

Therefore it suffices to prove the formula for t = 1. We prove this case by induction on m. First, we have

I(a_{1}; 1) = ∫_{0}^{1} x_{1}^{a_{1}}dx_{1} = \frac{1}{a_{1} + 1} = \frac{Γ(a_{1} + 1)}{Γ(a_{1} + 2)}.

Let

Z(x_{m})′ = {x ∈ ℝ^{m−1} | x_{i} ≥ 0, ∑ x_{i} ≤ 1 − x_{m}}.

Then

I(a_{1}, ..., a_{m}; 1) = ∫_{0}^{1} x_{m}^{a_{m}} (∫_{Z(x_{m})′} x_{1}^{a_{1}} ⋯ x_{m−1}^{a_{m−1}}dx_{1} ⋯ dx_{m−1}) dx_{m},

= ∫_{0}^{1} x_{m}^{a_{m}}I(a_{1}, ..., a_{m−1}; 1 − x_{m})dx_{m}

= I(a_{1}, ..., a_{m−1}; 1) ∫_{0}^{1} x_{m}^{a_{m}}(1 − x_{m})^{∑ a_{i}+m−1}dx_{m}

= I(a_{1}, ..., a_{m−1}; 1)\frac{Γ(a_{m} + 1)Γ(a_{1} + ⋯ + a_{m−1} + m)}{Γ(a_{1} + ⋯ + a_{m} + m + 1)}.

In the last step, we used the standard formula

∫_{0}^{1} x^{m−1}(1 − x)^{n−1}dx = B(m, n) = \frac{Γ(m)Γ(n)}{Γ(m + n)}. □

Example 4.23. (a) Case r = 2, s = 0. Then X(t) is defined by |x| + |y| ≤ t. It is a square of side \sqrt{2}t, and so μ(X(t)) = 2t^{2}.

(b) Case r = 0, s = 1. Then X(t) is the circle of radius t/2, which has area πt^{2}/4.

Lemma 4.24. Let a_{1}, …, a_{n} be positive real numbers. Then

(∏ a_{i})^{1/n} ≤ (∑ a_{i})/n;

equivalently,

∏ a_{i} ≤ (∑ a_{i})^{n}/n^{n}.

(The geometric mean is less than or equal to the arithmetic mean.)

Proof. See any good course on advanced calculus. □

Finiteness of the class number. Let K be number field of degree n over ℚ. Suppose that K has r real embeddings {σ_{1}, …, σ_{r}} and 2s complex embedding {σ_{r+1}, σ̄_{r+1}, …, σ_{r+s}, σ̄_{r+s}}. Thus n = r + 2s. We have an embedding

σ: K ↪ ℝ^{r} × ℂ^{s}, α ↦ (σ_{1}α, …, σ_{r+s}α).

We identify V =_{df} ℝ^{r} × ℂ^{s} with ℝ^{n} using the basis {1, i} for ℂ.

Proposition 4.25. Let 𝔞 be an ideal in O_{K}; then σ(𝔞) is a full lattice in V, and the volume of a fundamental parallelopiped of σ(𝔞) is 2^{−s} · ℕ𝔞 · |Δ|^{\frac{1}{2}} .

Proof. Let α_{1}, …, α_{n} be a basis for 𝔞 as a ℤ-module. To prove that σ(𝔞) is a lattice we show that the vectors σ(α_{1}), …, σ(α_{n}) are linearly independent, and we prove this by showing that the matrix A, whose i^{th} row is

(σ_{1}(α_{i}), …, σ_{r}(α_{i}), ℜ(σ_{r+1}α_{i}), ℑ(σ_{r+1}α_{i}), …)

has nonzero determinant.

First consider the matrix B whose i^{th} row is

(σ_{1}(α_{i}), …, σ_{r}(α_{i}), σ_{r+1}(α_{i}), \overline{σ_{r+1}(α_{i})}, …, \overline{σ_{r+s}(α_{i})}).

We saw in (2.25) that det(B)^{2} = disc(α_{1}, …, α_{n}) ≠ 0.

What is the relation between the determinants of A and B? Add column r +2 in B to column r+1, and then subtract 1/2 column r+1 from column r+2. This gives us 2ℜ(σ_{r+1}(a_{i})) in column r + 1 and −iℑ(σ_{r+1}(α_{i})) in column r + 2. Repeat for the other pairs of columns. These column operations don’t change the determinant of B, and so

det(B) = (−2i)^{s} det(A),

or

det(A) = (−2i)^{−s} det(B) = (−2i)^{−s} disc(α_{1}, …, α_{n})^{1/2} ≠ 0.

Thus σ(𝔞) is a lattice in V.

Since σ(𝔞) = ∑_{i=1}^{n} ℤσ(α_{i}), the volume of a fundamental parallelopiped D for σ(𝔞) is | det(A)|, and from (2.24) we know that

| disc(α_{1}, …, α_{n})| = (O_{K} : 𝔞)^{2} · | disc(O_{K}/ℤ)|.

Hence

μ(D) = 2^{−s} · | disc(α_{1}, …, α_{n})|^{\frac{1}{2}} = 2^{−s} · ℕ𝔞 · |Δ_{K}|^{\frac{1}{2}} . □

Proposition 4.26. Let 𝔞 be an ideal in O_{K}. Then 𝔞 contains an element α of K with

| Nm(α)| ≤ B_{K} · ℕ𝔞 = (\frac{4}{π} )^{s} \frac{n!}{n^{n}} ℕ𝔞|Δ|^{\frac{1}{2}} .

Proof. Let X(t) be as in (4.21). It is compact convex and symmetric in the origin. Choose t so large that μ(X(t)) ≥ 2^{n} · μ(D). Then (4.18) shows that X(t) contains a point σ(α) ≠ 0 of σ(𝔞). Thus α ∈ 𝔞 and

| Nm(α)| = |σ_{1}(α)| ⋯ |σ_{r}(α)||σ_{r+1}(α)|^{2} ⋯ |σ_{r+s}(α)|^{2}
≤ (∑ |σ_{i}α| + ∑ 2|σ_{i}α|)^{n}/n^{n} (by 4.24)
≤ t^{n}/n^{n}.

We need t large enough so that [[This argument is correct, but confusing.]]

2^{r}(π/2)^{s}t^{n}/n! ≥ 2^{n} · 2^{−s} · ℕ𝔞 · |Δ_{K}|^{\frac{1}{2}} ,

i.e.,

t^{n} ≥ n! · \frac{2^{n−r}}{π^{s}} · ℕ𝔞 · |Δ_{K}|^{\frac{1}{2}} .

Thus we see

| Nm(α)| ≤ \frac{n!}{n^{n}} · \frac{2^{n−r}}{π^{s}} · ℕ𝔞 · |Δ_{K}|^{\frac{1}{2}} .

As n − r = 2s, this is the required formula. □

Proof (of Theorem 4.3). Let 𝔠 be a fractional ideal in K—we have to show that the class of 𝔠 in the ideal class group is represented by an integral ideal 𝔞 with

ℕ𝔞 ≤ B =_{df} \frac{n!}{n^{n}} (\frac{4}{π} )^{s} |Δ_{K}|^{\frac{1}{2}} .

For some d ∈ K^{×}, d𝔠^{−1} is an integral ideal, say (d) · 𝔠^{−1} = 𝔟. According to the result just proved, there is a β ∈ 𝔟, β ≠ 0, with

| Nm(β)| ≤ B · ℕ𝔟.

Now βO_{K} ⊂ 𝔟 ⟹ βO_{K} = 𝔞𝔟 with 𝔞 integral, and 𝔞 ∼ 𝔟^{−1} ∼ 𝔠. Moreover,

ℕ𝔞 · ℕ𝔟 = | Nm_{L/K} β| ≤ B · ℕ𝔟.

On cancelling ℕ𝔟, we find that ℕ𝔞 ≤ B. □

Remark 4.27. Proposition 4.26 can be useful in deciding whether an integral ideal is principal.

Binary quadratic forms. The first person to consider class numbers (implicitly) was Gauss. Rather than working with ideals, which hadn’t been defined then, he worked with binary quadratic forms.

By a binary quadratic form, we mean an expression of the form:

Q(X, Y) = aX^{2} + bXY + cY^{2}.

We call the form integral if Q(m, n) is an integer whenever m and n are, or, equivalently, if a, b, c ∈ ℤ. The discriminant of Q is

d_{Q} = b^{2} − 4ac.

A form is said to be nondegenerate if its discriminant is nonzero. Two integral binary quadratic forms Q and Q′ are said to be equivalent if there exists a matrix

A = ( \begin{matrix}α & β \\ γ & δ \end{matrix} ) ∈ SL_{2}(ℤ) such that

Q′(X, Y) = Q(αX + βY, γX + δY).

Clearly, equivalent forms have the same discriminant, but there exist inequivalent forms with the same discriminant. The question considered by Gauss was to try to describe the set of equivalence classes of forms with a fixed discriminant. As we shall explain, this question can be interpreted in terms of ideals.

Let d ≠ 1 be a square-free integer, let K = ℚ[\sqrt{d}], and let d_{K} = disc(O_{K}/ℤ). Define the norm form q_{K} by

q_{K}(X, Y) = Nm_{K/ℚ}(X + Y \sqrt{d}) = X^{2} − dY^{2}, if d ≡ 2, 3 mod 4

or

q_{K}(X, Y) = Nm_{K/ℚ}(X + Y \frac{1 + \sqrt{d}}{2}) = X^{2} + XY + \frac{1 − d}{4}Y^{2}, if d ≡ 1 mod 4.

In both cases q_{K} has discriminant d_{K} (= 4d or d).

In general, if Q is an integral binary quadratic form, then d_{Q} = d_{K}f^{2}, some integer f, where K = ℚ[\sqrt{d_{Q}}]. Moreover, if d_{Q} = d_{K}, then Q is primitive, i.e., gcd(a, b, c) = 1.

Fix a field K = ℚ[\sqrt{d}] and an embedding K ↪ ℂ. We choose \sqrt{d} to be positive if d > 0 and to have positive imaginary part if d is negative. Set \sqrt{d_{K}} = 2\sqrt{d} or \sqrt{d}. Write Gal(K/ℚ) = \{1, σ\}. If d < 0, define Cl^{+}(K) = Cl(K) (usual class group of K) and if d > 0, define

Cl^{+}(K) = Id(K)/P^{+}(K)

where P^{+}(K) is the group of principal ideals of the form (α) with α > 0 under every embedding of K into ℝ.

Let 𝔞 be a fractional ideal in K, and let a_{1}, a_{2} be a basis for 𝔞 as a ℤ-module. From (2.24) we know that

| \begin{matrix}a_{1} & a_{2} \\ σa_{1} & σa_{2} \end{matrix} |^{2} = d_{K}ℕ𝔞^{2}.

After possibly reordering the pair a_{1}, a_{2} we will have

| \begin{matrix}a_{1} & a_{2} \\ σa_{1} & σa_{2} \end{matrix} | = \sqrt{d_{K}}ℕ𝔞.

For such a pair, define

Q_{a_{1},a_{2}}(X, Y) = ℕ𝔞^{−1} · Nm_{K/ℚ}(a_{1}X + a_{2}Y).

This is an integral binary quadratic form with discriminant d_{K}.

Theorem 4.28. The equivalence class of Q_{a_{1},a_{2}}(X, Y) depends only on the image of 𝔞 in Cl^{+}(K); moreover, the map sending 𝔞 to the equivalence class of Q_{a_{1},a_{2}} defines a bijection from Cl^{+}(K) to the set of equivalence classes of integral binary quadratic forms with discriminant d_{K}.

Proof. See Fröhlich and Taylor, VII.2 (and elsewhere). □

In particular, the set of equivalence classes is finite, and has the structure of an abelian group. This was known to Gauss, even though groups had not yet been defined. (Gauss even knew it was a direct sum of cyclic groups.)

Remark 4.29. Write h_{d} for the class number of ℚ[\sqrt{d}], d a square-free integer ≠ 1. In modern terminology, Gauss conjectured that, for a fixed h, there are only finitely many negative d such that h_{d} = h. (Actually, because of a difference of terminology, this is not quite what Gauss conjectured.)

In 1935, Siegel showed that, for every ε > 0, there exists a constant c > 0 such that

h_{d} > c|d|^{\frac{1}{2} −ε}, d < 0.

This proves Gauss’s conjecture. Unfortunately, the c in Siegel’s theorem is not effectively computable, and so Siegel’s theorem gives no way of computing the d’s for a given h.

In 1951, Tatuzawa showed that Siegel’s theorem is true with an effectively computable c except for at most one exceptional d.

It is easy to show that h_{d} = 1 for −d = 1, 2, 3, 7, 11, 19, 43, 67, 163 (exercise!). Thus in 1951 it was known that there exist these 9 quadratic imaginary number fields with class number 1, and possibly 1 more.

In 1952 Heegner proved that there was no 10^{th} such field, but his proof was not recognized to be correct for many years.

More recently (1983), Goldfeld, Gross, and Zagier showed, using completely different methods from Siegel, that there is an effective procedure for finding all d < 0 with h_{d} equal to a given h. For an expository article on this, see Goldfeld, Bull. AMS 13 (1985), 23–37.

By way of contrast, it is conjectured that there are infinitely many real quadratic fields with class number 1, but this has not been proved.

There are tables of class numbers at the back of Borevich and Shafarevich (and elsewhere).

§5. The Unit Theorem

In this section we prove the second main theorem of the course.

Statement of the theorem. Recall that a finitely generated abelian group A is isomorphic to A_{tors} ⊕ ℤ^{r} for some r where A_{tors} is the (finite) subgroup of torsion elements of A (i.e., of elements of finite order). The number r is uniquely determined by A, and is called the rank of A.

Theorem 5.1. The group of units in a number field K is finitely generated with rank equal to r + s − 1.

The theorem is usually referred to as the “Dirichlet unit theorem” although Dirichlet in fact proved it for rings of the form ℤ[α] rather than O_{K} (see p7).

Write U_{K} (= O_{K}^{×}) for the group of units in K. The torsion subgroup of U_{K} is (obviously) the group μ(K) of roots of 1 in K.

A set of units u_{1}, …, u_{r+s−1} is called a fundamental system of units if it forms a basis for U_{K} modulo torsion, i.e., if every unit u can be written uniquely in the form

u = ζu_{1}^{m_{1}} ⋯ u_{r+s−1}^{m_{r+s−1}}, ζ ∈ μ(K), m_{i} ∈ ℤ.

The theorem implies that μ(K) is finite (and hence cyclic—see Math 594). This can be proved directly. In §7, we shall see that, if ζ_{m} is a primitive m^{th} root of 1, then ℚ[ζ] is a Galois extension of ℚ with Galois group isomorphic to (ℤ/mℤ)^{×}. Note that

#(ℤ/mℤ)^{×} = #{n | 0 ≤ n ≤ m−1, gcd(n, m) = 1} =_{df} φ(m) (Euler φ-function)

and

φ(m) = ∏ φ(p_{i}^{r_{i}}) = ∏ p^{r_{i}−1}(p_{i} − 1), for m = ∏ p_{i}^{r_{i}},

which increases with m. Since

ζ_{m} ∈ K ⟹ ℚ[ζ_{m}] ⊂ K ⟹ φ(m)|[K : ℚ],

this implies that μ(K) is finite.

Lemma 5.2. An element α ∈ K is a unit if and only if α ∈ O_{K} and Nm_{K/ℚ} α = ±1.

Proof. If α is a unit, then there is a β ∈ O_{K} such that αβ = 1, and then Nm(α) and Nm(β) lie in ℤ and 1 = Nm(αβ) = Nm(α)·Nm(β). Hence Nm α ∈ ℤ^{×} = {±1}.

For the converse, fix an embedding σ_{0} of K into ℂ, and use it to identify K with a subfield of ℂ. Recall (2.19) that

Nm α = ∏_{σ} σα = α · ∏_{σ≠σ_{0}} σα, σ: K ↪ ℂ.

Let β = ∏_{σ≠σ_{0}} σα. If α ∈ O_{K} then β is an algebraic integer. If Nm α = ±1, then β = ±α^{−1} and so belongs to K. Therefore, if α satisfies both conditions, it has an inverse ±β in O_{K}, and so is a unit. □

For all real fields, i.e., fields with an embedding into ℝ, μ(K) = {±1}; for “most” nonreal fields, this is also true.

Example 5.3. Let K be a quadratic field ℚ[\sqrt{d}]. Then O_{K} = \{m + n\sqrt{d} | m, n ∈ ℤ\} or \{m + n(1 + \sqrt{d})/2 | m, n ∈ ℤ\}. The units in K are given by the solutions of the equation:

m^{2} − n^{2}d = ±1, or (2m + n)^{2} − dn^{2} = 4.

When d < 0, these equations (obviously) have only finitely many solutions, and so U_{K} = μ(K). Note that ζ_{m} lies in a quadratic field if and only if φ(m) ≤ 2. This only happens for m dividing 4 or 6. Thus μ(K) = {±1} except for the following fields:

ℚ[i], μ(K) = {±1, ±i};

ℚ[\sqrt{−3}], μ(K) = \{±1, ±ρ, ±ρ^{2}\}, with ρ = (1 + \sqrt{−3})/2). When d > 0, the theorem shows that there are infinitely many solutions, and that U_{K} = ±u^{ℤ} for some element u (called the fundamental unit). As H. Cohn (A Classical Invitation...) puts it, “the actual computation of quadratic units lies in the realm of popularized elementary number theory, including devices such as continued fractions.” The method is surprisingly effective, and yields some remarkably large numbers—see later.

Example 5.4. Let K = ℚ[α], where α be a root of X^{3} + 10X + 1. We know that the discriminant Δ_{K} = −4027. Since sign(Δ_{K}) = (−1)^{s} and r + 2s = 3, we must have r = 1 = s. From its minimum equation, we see that Nm α = −1, and so α is a unit. Later we shall show that α is a fundamental unit, and so U_{K} = {±α^{m} | m ∈ ℤ}.

Proof that U_{K} is finitely generated. We first need a simple lemma.

Lemma 5.5. For any integers m and M, the set of all algebraic integers α such that

(i) the degree of α is ≤ m, and (ii) |α′| < M for all conjugates α′ of α

is finite.

Proof. The first condition says that α is a root of a monic irreducible polynomial of degree ≤ m, and the second condition implies that the coefficients of the polynomial are bounded. Since the coefficients are integers, there are only finitely many such polynomials, and hence only finitely many αs. □

Recall that we previously considered the map

σ: K → ℝ^{r} × ℂ^{s}, α ↦ (σ_{1}α, …, σ_{r}α, σ_{r+1}α, …, σ_{r+s}α)

where {σ_{1}, …, σ_{r}, σ_{r+1}, σ̄_{r+1}, …, σ_{r+s}, σ̄_{r+s}} is the complete set of embeddings of K into ℂ. It takes sums to sums. Now we want a map that takes products to sums, and so we take logarithms. Thus we consider the map:

L: K^{×} → ℝ^{r+s}, α ↦ (log |σ_{1}α|, …, log |σ_{r}α|, 2 log |σ_{r+1}α|, …, 2 log |σ_{r+s}α|).

It is a homomorphism. If u is a unit in O_{K}, then Nm_{K/ℚ} u = ±1, i.e.,

|σ_{1}α| ⋯ |σ_{r}α||σ_{r+1}α|^{2} ⋯ |σ_{r+s}α|^{2} = 1.

On taking logs, we see that L(u) is contained in the hyperplane

H: x_{1} + ⋯ + x_{r} + 2x_{r+1} + ⋯ + 2x_{r+s} = 0.

Dropping the last coordinate defines an isomorphism H ≈ ℝ^{r+s−1}.

Proposition 5.6. The image of L: U → H is a lattice in H, and the kernel of L is a finite group (hence is μ(K)).

Proof. Let C be a bounded subset of H containing 0, say

C ⊂ {x ∈ H | |x_{i}| ≤ M}.

If L(u) ∈ C, then |σ_{j}u| ≤ e^{M} for all j, and Lemma 5.5 implies that there are only finitely many such us. Thus L(U) ∩ C is finite, and this implies that L(U) is a lattice in H (by 4.14). Since everything in the kernel maps into C, the kernel is finite. □

Since the kernel of L is finite, we have

rank(U) = rank(L(U)) ≤ dim H = r + s − 1.

Computation of the rank. We now prove the unit theorem.

Theorem 5.7. The image L(U) of U in H is a full lattice; thus U has rank r+s−1.

Proof. To prove the theorem, we have to find a way to construct units. We work again with the embedding

σ: K ↪ ℝ^{r} × ℂ^{s} ≈ ℝ^{r+2s}.

For x = (x_{1}, ..., x_{r}, x_{r+1}, ...) ∈ ℝ^{r} × ℂ^{s}, define

Nm(x) = x_{1} ⋯ x_{r} · x_{r+1} · x̄_{r+1} ⋯ x_{r+s} · x̄_{r+s}.

Then Nm(σ(α)) = Nm(α). Note that | Nm(x)| = |x_{1}| ⋯ |x_{r}||x_{r+1}|^{2} ⋯ |x_{r+s}|^{2}.

Recall from (4.25), that σ(O_{K}) is a full lattice in ℝ^{r} × ℂ^{s}, and the volume of its fundamental parallelopiped is 2^{−s} · |Δ|^{\frac{1}{2}} ; in more detail, if α_{1}, …, α_{n} is a ℤ-basis for O_{K}, then we showed that the absolute value of the determinant of the matrix whose i^{th} row is

σ(α_{i}) = (σ_{1}(α_{i}), …, ℜ(σ_{r+1}(α_{i})), ℑ(σ_{r+1}(α_{i})), …)

is 2^{−s} · |Δ|^{\frac{1}{2}} . In fact, we showed that we could get this matrix from the matrix whose i^{th} row is

(σ_{1}(α_{i}), …, σ_{r+1}(α_{i}), σ̄_{r+1}(α_{i}), …)

by some elementary column operations that multiplied the absolute value of the determinant by 2^{−s}, and we know that the determinant of the second matrix is ±|Δ|^{\frac{1}{2}} .

In the rest of the proof, x will be a point of ℝ^{r} × ℂ^{s} with

1/2 ≤ | Nm(x)| ≤ 1.

Define

x · σ(O_{K}) = {x · σ(α) | α ∈ O_{K}}.

Since ℝ^{r} × ℂ^{s} is a ring, this product makes sense. This is again a lattice in ℝ^{r} × ℂ^{s}, and the volume of its fundamental parallelopiped is the determinant of the matrix whose i^{th} row is

(x_{1}σ_{1}(α_{i}), …, ℜ(x_{r+1}σ_{r+1}(α_{i})), ℑ(x_{r+1}σ_{r+1}(α_{i})), …).

As before, the absolute value of the determinant of this matrix is 2^{−s} times the absolute value of the determinant of the matrix whose i^{th} row is

(x_{1}σ_{1}(α_{i}), …, x_{r+1} · σ_{r+1}(α_{i}), x̄_{r+1} · σ̄_{r+1}(α_{i}), …),

which is

|Δ|^{\frac{1}{2}} · | Nm(x)|.

Therefore x · σ(O_{K}) is a lattice with 2^{−s}|Δ|^{\frac{1}{2}} |Nm(x)| as the volume of its fundamental domain. Note that as x ranges over our set these volumes remain bounded.

Let T be a compact convex subset of ℝ^{r} × ℂ^{s}, which is symmetric in the origin, and whose volume is so large that, for every x in the above set, Minkowski’s theorem (4.18) implies there is a point γ of O_{K}, γ ≠ 0, such that x · σ(γ) ∈ T. The points of T, have bounded coordinates, and hence bounded norms, and so

x · σ(γ) ∈ T ⟹ | Nm(x · σ(γ))| ≤ M,

for some M (depending on T); thus

| Nm(γ)| ≤ M/ Nm(x) ≤ 2M.

Consider the set of ideals γ · O_{K}, where γ runs through the γs in O_{K} for which x · σ(γ) ∈ T for some x in our set. The norm ℕ of such an ideal is ≤ 2M, and so there can only be finitely many such ideals, say γ_{1} · O_{K}, …, γ_{t} · O_{K}. Now if γ is any element of O_{K} with x · σ(γ) ∈ T, some x, then γ · O_{K} = γ_{i} · O_{K} for some i, and so there exists a unit ε such that γ = γ_{i} · ε. Then x · σ(ε) ∈ σ(γ_{i}^{−1}) · T. The set T′ = σ(γ_{1}^{−1}) · T ∪ ... ∪ σ(γ_{t}^{−1}) · T is bounded, and so we have shown that, for each x in our set there exists a unit ε such that the coordinates of x · σ(ε) are bounded uniformly in x (the set T′ doesn’t depend on x).

We are now ready to prove that L(U) is a full lattice in H. If r + s − 1 = 0, there is nothing to prove, and so we assume r + s − 1 ≥ 1.

For each i, 1 ≤ i ≤ r + s, we choose an x in our set such that all the coordinates of x except x_{i} are very large (compared with T′), and x_{i} is sufficiently small that | Nm x| = 1. We know that there exists a unit ε_{i} such that x · σ(ε_{i}) has bounded coordinates, and we deduce that |σ_{j}ε_{i}| < 1 for j ≠ i, and hence that log |σ_{j}ε_{i}| < 0.

I claim that L(ε_{1}), ..., L(ε_{r+s−1}) are linearly independent vectors in the lattice L(U). For this we have to prove that the matrix whose i^{th} row is

(l_{1}(ε_{i}), ..., l_{r+s−1}(ε_{i})), l_{i}(ε) = log |σ_{i}ε|,

is invertible. The elements of the matrix except those on the diagonal are negative, but the sum

l_{1}(ε_{i}) + ⋯ + l_{r+s−1}(ε_{i}) + l_{r+s}(ε_{i}) = 0,

and so the sum of the terms in the i^{th} row

l_{1}(ε_{i}) + ⋯ + l_{r+s−1}(ε_{i}) = −l_{r+s}(ε_{i}) > 0.

The next lemma implies that the matrix is invertible, and so completes the proof of Theorem 5.7.

Lemma 5.8. Let (a_{ij}) be a real m × m matrix such that (a) a_{ij} < 0 for i ≠ j;

(b) ∑_{j} a_{ij} > 0 for i = 1, 2, ..., m. Then (a_{ij}) is invertible.

Proof. If it isn’t, then the system of equations

∑ a_{ij}x_{j} = 0

has a nontrivial solution. Write x_{1}, ..., x_{m} for such a solution, and suppose i is such that |x_{i}| = max{|x_{j}|}. We can scale the solution so that x_{i} = 1. Then |x_{j}| ≤ 1 for j ≠ i, and the i^{th} equation is

0 = ∑ a_{ij}x_{j} = a_{ii} + ∑_{j≠i} a_{ij}x_{j} ≥ a_{ii} + ∑_{j≠i} a_{ij} > 0. □

S-units. Let S be a finite set of prime ideals of K, and define the ring of S-integers to be

O_{K}(S) = ∩_{𝔭∉S}O_{𝔭} = {α ∈ K | ord_{𝔭}(α) ≥ 0, all 𝔭 ∉ S}.

For example, if S = ∅, then O_{K}(S) = O_{K}.

Define the group of S-units, to be

U(S) = O_{K}(S)^{×} = {α ∈ K | ord_{𝔭}(α) = 0, all 𝔭 ∉ S}.

Clearly, the torsion subgroup of U(S) is again μ(K).

Theorem 5.9. The group of S-units is finitely generated with rank r + s + #S − 1.

Proof. Let 𝔭_{1}, 𝔭_{2}, …, 𝔭_{t} be the elements of S. The homomorphism

u ↦ (…, ord_{𝔭_{i}}(u), …): U(S) ⟶ ℤ^{t}

obviously has kernel U. To complete the proof, it suffices to show that the image of U(S) in ℤ^{t} has rank t. Let h be the class number of K. Then 𝔭_{i}^{h} is principal, say 𝔭_{i}^{h} = (π_{i}), and π_{i} is an S-unit with image

(0, …, h, …, 0) (h in the i^{th} position).

Clearly these elements generate a subgroup of rank t. □

For example, if K = ℚ and S = {(2), (3), (5)} then

U(S) = {±2^{k}3^{m}5^{n} | k, m, n ∈ ℤ},

and the statement is obvious in this case.

Finding fundamental units in real quadratic fields. An expression

a_{0} + \frac{1}{a_{1} + \frac{1}{a_{2} + \frac{1}{a_{3} + …}}}

is called a continued fraction. We abbreviate the expression on the right as

[a_{0}, a_{1}, a_{2}, …].

We shall always assume that the a_{i} are integers with a_{1} > 0, a_{2} > 0, . . .. The integers a_{i} are called the quotients, and [a_{0}, a_{1}, ..., a_{n}] is called the n^{th} convergent. Every irrational number α can be expressed in just one way as an infinite continued fraction, and the continued fraction is periodic if and only if α has degree 2 over ℚ. (See any book on elementary number theory, for example, Hardy and Wright, Chapter X.)

Now let d be a square-free positive integer, and let ε be the (unique) fundamental unit for ℚ[\sqrt{d}] with ε > 1. Let s be the period of the continued fraction for \sqrt{d} and let p/q be the (s − 1)^{th} convergent of it; then

ε = p + q\sqrt{d} if d ≡ 2, 3 mod 4, or d ≡ 1 mod 8,

and

ε = p + q\sqrt{d} or ε^{3} = p + q\sqrt{d} otherwise.

Using Maple or Mathematica, it is very easy to carry this out, and one obtains some spectacularly large numbers.

For example, to find the fundamental unit in ℚ[\sqrt{94]}, first compute \sqrt{94} = 9, 695 . . .. Then compute the continued fraction of \sqrt{94}. One gets

{9, 1, 2, 3, 1, 1, 5, 1, 8, 1, 5, 1, 1, 3, 2, 1, 18, 1, 2, 3, … }.

This suggests the period is 16. Now evaluate the 15^{th} convergent. One gets

\frac{2143295}{221064}

Then the fundamental unit > 1 is

ε = 2143295 + 221064 · \sqrt{94}.

Compute that

(2143295)^{2} − (221064)^{2} · 94 = 1,

which verifies that ε is a unit.

When one carries out this procedure for ℚ[\sqrt{9199]}, the first coefficient of the fundamental unit has 88 digits! The computer has no problem finding the fundamental unit—the only problem is counting the length of the period, which is about 180.

Units in cubic fields with negative discriminant. Since the sign of the discriminant is (−1)^{s} (see 2.39), a cubic field K will have negative discriminant if and only if r = 1 = s. We identify K with a subfield of ℝ (using its unique real embedding). We have Δ < 0, and the group of units is {±ε^{m}} for some ε (fundamental unit). We want to find ε. Since -ε, −ε^{−1}, and ε^{−1} are also fundamental units, we may suppose that ε > 1.

Lemma 5.10. Let K be a cubic extension of ℚ with negative discriminant, and let ε be the fundamental unit with ε > 1. Then

|Δ_{K}| < 4ε^{3} + 24.

Proof. Since ε ∉ ℚ, it must generate K. The two conjugates of ε (other than ε itself) must be complex conjugates, and so the product of ε with its conjugates must be +1 (rather than −1). Write ε = u^{2}, u ∈ ℝ, u > 1. Then the remaining conjugates of ε can be written

u^{−1}e^{iθ}, u^{−1}e^{−iθ} (0 ≤ θ ≤ π).

Let Δ′ = D(1, ε, ε^{2}) be the discriminant of the minimum equation of ε. Then

Δ′^{\frac{1}{2}} = (u^{2} − u^{−1}e^{iθ})(u^{2} − u^{−1}e^{−iθ})(u^{−1}e^{iθ} − u^{−1}e^{−iθ}) = 2i(u^{3} + u^{−3} − 2 cos θ) sin θ.

If we set 2ξ = u^{3} + u^{−3}, then

|Δ′|^{\frac{1}{2}} = 4(ξ − cos θ) sin θ,

which, for a given u, has a maximum where

ξ cos θ − cos^{2} θ + sin^{2} θ = 0,

or

−g(x) =_{df} ξx − 2x^{2} + 1 = 0, |x| ≤ 1, x = cos θ.

We seek a root of g(x) with |x| < 1. But g(1) = 1 − ξ < 0 (because u > 1 implies ξ = \frac{u^{3}−u^{−3}}{2} > 1), and g(−\frac{1}{2u^{3}} ) = \frac{3}{4}(u^{−6} − 1) < 0. Since g(x) = 2x^{2} + ⋯, it follows g(x) has one root > 1, and that the desired root x_{0}, with |x_{0}| ≤ 1, is < −\frac{1}{2u^{3}} . But then

x_{0}^{2} > \frac{1}{4u^{6}} ⟹ u^{−6} − 4x_{0}^{2} < 0 ⟹ u^{−6} − 4x_{0}^{−2} − 4x_{0}^{4} < 0.  (*)

This maximum yields

|Δ′| ≤ 16(ξ^{2} − 2ξx_{0} + x_{0}^{2})(1 − x_{0}^{2}),

and, on applying the conditions ξx_{0} = 2x_{0}^{2} − 1, ξ^{2}x_{0}^{2} = 4x_{0}^{4} − 4x_{0}^{2} + 1, and the inequality (*) we find that

|Δ′| ≤ 16(ξ^{2} + 1 − x_{0}^{2} − x_{0}^{4}) = 4u^{6} + 24 + 4(u^{−6} − 4x_{0}^{2} − 4x_{0}^{4}) < 4u^{6} + 24.

Hence

|Δ′| < 4ε^{3} + 24.

Since Δ_{K} = Δ′ · (square of an integer), this completes the proof. □

Example 5.11. Let K = ℚ[α] where α is a real root of X^{3} + 10X + 1. Here the

discriminant is -4027, and so ε > \sqrt[3]{\frac{4027−24}{4}} > 10 for ε the fundamental unit with ε > 1. Note that Nm(α) = −1, and so α is a unit. Moreover, α = −0.0999003... and so β = −α^{−1} = 10.00998.... Since β is a power of ε, we must have β = ε; i.e., −α^{−1} is the fundamental unit > 1. Thus

U_{K} = {±α^{m} | m ∈ ℤ}.

Once one knows ε, it becomes easier to compute the class group. We know (see p61) that there is a prime ideal 𝔭 = (2, 1 + α) such that ℕ(𝔭) = 2. One shows that 𝔭 generates the class group, and it then remains to find the order of 𝔭. One verifies that 𝔭^{6} is the ideal generated by \frac{(α−1)^{3}}{α+2} , and so it remains to show that 𝔭^{2} and 𝔭^{3} are nonprincipal.

Suppose 𝔭^{3} = (γ). Then γ^{2} = ±α^{m} · \frac{(α−1)^{3}}{α+2} for some m and choice of signs. But this says that at least one of the numbers \frac{α−1}{α+2}, −\frac{α−1}{α+2}, α\frac{α−1}{α+2}, −α\frac{α−1}{α+2} is a square. Let β be that number. If 𝔮 is a prime ideal such that β ∈ O_{𝔮} (i.e., such that ord_{𝔮}(β) ≥ 0), then we can look at β mod 𝔮 and ask if it is a square.

We first work modulo 29. We have

X^{3} + 10X + 1 ≡ (X + 5)(X − 3)(X − 2) mod 29.

Take 𝔮 to be the ideal (29, α − 2). The residue field O_{K}/𝔮 is 𝔽_{29} = ℤ/(29), and the map ℤ[α] → 𝔽_{29} is α ↦ 2 (mod 29). Thus

α − 1 ↦ 1, α + 2 ↦ 4, (α + 2)^{−1} ↦ 22, −1 ↦ −1.

The numbers 1, 4, and −1 ≡ 12^{2} are squares modulo 29, but 2 is not; hence m must be 0. Since \frac{α−1}{α+2} < 0 it can’t be a square in K (since it isn’t even in ℝ), and so the only possibility for β is −\frac{α−1}{α+2}. We eliminate this by looking mod 7.

Take 𝔮 = (7, α + 3) (see p61). Then in the map ℤ[α] → ℤ[α]/𝔮 = 𝔽_{7},

α ↦ −3 = 4, −\frac{α − 1}{α + 2} ↦ \frac{−3}{6} ≡ −\frac{1}{2} ≡ −4 ≡ 3 mod 7,

and 3 is not a square modulo 7. Thus −\frac{α−1}{α+2} is not a square in ℚ[α].

Similarly, 𝔭^{2} = (γ) can be shown to be impossible. Thus Cl(O_{K}) is a cyclic group of order 6.

Finding μ(K). If ℚ[ζ_{m}] ⊂ K, where ζ_{m} is a primitive m^{th} root of 1, then φ(m)|[K: ℚ]. Thus there are only finitely many possibilities for m. For each of them, use the test in the later section on algorithms to determine whether the minimum polynomial Φ_{m} for ζ_{m} has a root in K.

Finding a system of fundamental units. The strategy for finding units in the general case seems to be to find lots of solutions to equations Nm(α) = m, for m a fixed small number, and then take quotients of solutions. Note that there can be only finitely many ideals 𝔞 with ℕ(𝔞) = m; thus if we have lots of elements α_{i} with Nm(α_{i}) = m, then frequently α_{i} · O_{K} = α_{j} · O_{K}, and this implies that α_{i} and α_{j} differ by a unit—note that this was the strategy used to prove the unit theorem. See P &Z Chapter 5.

Regulators. There is one other important invariant that we should define. Let t = r + s − 1, and let u_{1}, ..., u_{t} be a system of fundamental units. Then the vectors

L(u_{i}) =_{df} (log |σ_{1}u_{i}|, ..., log |σ_{r}u_{i}|, 2 · log |σ_{r+1}u_{i}|, …, 2 log |σ_{t}u_{i}|) ∈ ℝ^{t}

generate the lattice L(U) in ℝ^{t}. The regulator is defined to be determinant of the matrix whose i^{th} row is L(u_{i}). Thus, up to sign, the regulator is the volume of a fundamental domain for L(U) (regarded as a full lattice in ℝ^{t}).

The regulator plays the same role for the group of units (mod torsion) that the discriminant plays for O_{K}. One can similarly define the regulator of any set {ε_{1}, ..., ε_{t}} of independent units, and the square of the index of the group generated by the ε_{i} and μ(K) in the full group of units is measured by ratio

|Reg(ε_{1}, …, ε_{t})|/|Reg(U)|.

There are lower bounds for the regulator (see P &Z p 365) similar to the one we proved for a cubic field with one real embedding.

§6. Cyclotomic Extensions; Fermat’s Last Theorem

Cyclotomic extensions of ℚ, i.e., extensions generated by a root of 1, provide interesting examples of the theory we have developed, but, more importantly, their arithmetic has important applications.

The basic results. An element ζ of a field K is said to be a primitive n^{th} root of 1 if ζ^{n} = 1 but ζ^{d} ≠ 1 for any d < n, i.e., if ζ is an element of order n in K^{×}. For example, the n^{th} roots of 1 in ℂ are the numbers e^{2πim/n}, 0 ≤ m ≤ n − 1, and the next lemma shows that e^{2πim/n} is a primitive n^{th} root of 1 if and only if m is relatively prime to n.

Lemma 6.1. Let ζ be a primitive n^{th} root of 1. Then ζ^{m} is again a primitive n^{th} root of 1 if and only if m is relatively prime to n.

Proof. This is a consequence of a more general fact: if α is an element of order n in a group, then α^{m} is also of order n if and only if m is relatively prime to n. Here is the proof. If d|m, n, then (α^{m})^{\frac{n}{d}} = α^{n \frac{m}{d}} = 1. Conversely, if m and n are relatively prime, then there are integers a and b such that

am + bn = 1.

Now α^{am} = α and so (α^{m})^{d} = 1 ⟹ α^{d} = (α^{am})^{d} = 1 ⟹ n|d. □

Let K = ℚ[ζ], where ζ is a primitive n^{th} root of 1. Then K is the splitting field of X^{n} − 1, and so it is Galois over ℚ. Let G = Gal(ℚ[ζ]/ℚ). It permutes the set of primitive n^{th} roots of 1 in K, and so, for any σ ∈ G, σζ = ζ^{m} for some integer m relatively prime to n; moreover, m is well-defined modulo n. The map σ ↦ [m] is an injective homomorphism G → (ℤ/nℤ)^{×}. In Math 594, one (sometimes) proves that this map is an isomorphism, and so [K: ℚ] = φ(n) =_{df} #(ℤ/nℤ)^{×}. We shall give another proof.

The cyclotomic polynomial Φ_{n} is defined to be,

Φ_{n}(X) = ∏(X − ζ^{m})

where the product runs over a set of representatives m for the elements of (ℤ/nℤ)^{×}, for example, over the integers m, 0 ≤ m ≤ n−1, relatively prime to n. Alternatively,

Φ_{n}(X) = ∏(X − ζ′)

where ζ′ runs over the primitive n^{th} roots of 1. Because G permutes the ζ′, Φ_{n}(X) ∈ ℚ[X], and clearly Φ_{n}(ζ) = 0. Therefore, Φ_{n}(X) is the minimum polynomial of ζ if and only if it is irreducible, in which case [K: ℚ] = φ(n) and the map G → (ℤ/nℤ)^{×} is an isomorphism. Hence the following statements are equivalent:

(a) the map Gal(ℚ[ζ]/ℚ) → (ℤ/nℤ)^{×} is an isomorphism;

(b) [ℚ[ζ] : ℚ] = φ(n);

(c) Gal(ℚ[ζ]/ℚ) acts transitively on the set of primitive n^{th} roots of 1 (i.e., they are conjugates);

(d) Φ_{n}(X) is irreducible (and so Φ_{n}(X) is the minimum polynomial of ζ).

We shall see that all these statements are true.

Note that each n^{th} root of 1 is a primitive d^{th} root of 1 for exactly one d|n, and so

X^{n} − 1 = ∏_{d|n} Φ_{d}(X) = (X − 1) ⋯ Φ_{n}(X).

We first examine a cyclotomic extension in the case that n is a power p^{r} of a prime.

Propostion 6.2. Let ζ be a primitive p^{r}th root of 1, and let K = ℚ[ζ]. (a) The field ℚ[ζ] is of degree φ(p^{r}) = p^{r−1}(p − 1) over ℚ.

(b) The ring of integers in ℚ[ζ] is ℤ[ζ].

(c) The element π =_{df} 1 − ζ is a prime element of O_{K}, and (p) = (π)^{e} with e = φ(p^{r}).

(d) The discriminant of O_{K} over ℤ is ±p^{c}, some c (in fact, c = p^{r−1}(pr −r −1)); therefore, p is the only prime to ramify in ℚ[ζ].

Proof. Observe first that ℤ[ζ] ⊂ O_{K} (obviously).

If ζ′ is another primitive p^{r}th root of 1, then ζ′ = ζ^{s} and ζ = ζ′^{t} for some integers s and t not divisible by p, and so ℚ[ζ′] = ℚ[ζ], ℤ[ζ′] = ℤ[ζ]. Moreover,

\frac{1 − ζ′}{1 − ζ} = 1 + ζ + ⋯ + ζ^{s−1} ∈ ℤ[ζ].

Similarly, (1 − ζ)/(1 − ζ′) ∈ ℤ[ζ], and so (1 − ζ′)/(1 − ζ) is a unit in ℤ[ζ] (hence also in O_{K}). Note that

Φ_{p^{r}}(X) = \frac{X^{p^{r}} − 1}{X^{p^{r−1}} − 1} = \frac{t^{p} − 1}{t − 1} = 1 + t + … + t^{p−1}, t = X^{p^{r−1}},

and so

Φ_{p^{r}}(1) = p.

For its definition, we see that

Φ_{p^{r}}(1) = ∏(1 − ζ′) = ∏ \frac{1 − ζ′}{1 − ζ} (1 − ζ) = u · (1 − ζ)^{φ(p^{r})},

with u a unit in ℤ[ζ]. Therefore we have an equality of ideals in O_{K},

(p) = (π)^{e}, π = 1 − ζ, e = φ(p^{r}),

and so (p) has at least φ(p^{r}) prime factors in O_{K}. Now (3.36) implies that [ℚ[ζ] : ℚ] ≥ φ(p^{r}). This proves (a) of the Proposition since we know [ℚ[ζ] : ℚ] ≤ φ(p^{r}).

Moreover we see that π must generate a prime ideal in O_{K}, otherwise, again, (p) would have too many prime-ideal factors. This completes the proof of (c).

For future reference, we note that, in O_{K},

(p) = 𝔭^{φ(p^{r})}, 𝔭 = (π), f(𝔭/p) = 1.

The last equality means that the map ℤ/(p) → O_{K}/(π) is an isomorphism. We next show that (up to sign) disc(ℤ[ζ]/ℤ) is a power of p. Since

disc(O_{K}/ℤ) · (O_{K}: ℤ[ζ])^{2} = disc(ℤ[ζ]/ℤ),

this will imply:

(i) disc(O_{K}/ℤ) is a power of p; (ii) (O_{K}: ℤ[ζ]) is a power of p, and therefore p^{M}(O_{K}/ℤ[ζ]) = 0 for some M,

i.e., p^{M}O_{K} ⊂ ℤ[ζ]. To compute disc(ℤ[ζ]/ℤ), we shall use the formula in (2.33), which in our case reads:

disc(ℤ[ζ]/ℤ) = ± Nm_{K/ℚ}(Φ′_{p^{r}}(ζ)).

On differentiating the equation

(X^{p^{r−1}} − 1) · Φ_{p^{r}}(X) = X^{p^{r}} − 1

and substituting ζ for X, we find that Φ′_{p^{r}}(ζ) = p^{r}ζ^{p^{r}−1}/(ζ^{p^{r−1}} − 1). Clearly

Nm_{K/ℚ} ζ = ±1, Nm_{K/ℚ} p^{r} = (p^{r})^{φ(p^{r})} = p^{rφ(p^{r})}.

We shall show that

Nm_{K/ℚ}(1 − ζ^{p^{s}}) = p^{p^{s}}, 0 ≤ s < r,

and so

Nm_{K/ℚ} Φ′_{p^{r}}(ζ) = ±p^{c}, c = r(p − 1)p^{r−1} − p^{r−1} = p^{r−1}(pr − r − 1).

First we compute Nm_{K/ℚ}(1−ζ). The minimum polynomial of 1−ζ is Φ_{p^{r}}(1−X), which has constant term Φ_{p^{r}}(1) = p, and so Nm_{K/ℚ}(1 − ζ) = ±p.

We next compute Nm(1 − ζ^{p^{s}}) some s < r. Because ζ^{p^{s}} is a primitive p^{r−s}th root of 1, the computation just made (with r replaced by r − s) shows that

Nm_{ℚ[ζ^{p^{s}}]/ℚ} 1 − ζ^{p^{s}} = ±p.

Using that

Nm_{M/K} = Nm_{L/K} ∘ Nm_{M/L} and Nm_{M/L} α = α^{[M : L]} if α ∈ L,

we see that

Nm_{K/ℚ}(1 − ζ^{p^{s}}) = p^{a} where a = [ℚ[ζ] : ℚ[ζ^{p^{s}}]] = φ(p^{r})/φ(p^{r−s}) = p^{s}.

This completes the proof of (d).

We are now ready to prove (b). As we observed above the inclusion ℤ ↪ O_{K} induces an isomorphism ℤ/(p) → O_{K}/(π). Thus

ℤ + πO_{K} = O_{K},

and a fortiori

ℤ[ζ] + πO_{K} = O_{K}.  (*)

On multiplying through by π, we obtain the equality

πℤ[ζ] + π^{2}O_{K} = πO_{K}.  (**)

Let α ∈ O_{K}; equation (*) shows that we can write α = α′ + γ with α′ ∈ πO_{K} and γ ∈ ℤ[ζ], and (**) shows that we can write α′ = α′′ + γ′ with α′′ ∈ π^{2}O_{K} and γ′ ∈ ℤ[ζ]. Hence α = (γ + γ′) + α′′, and so

ℤ[ζ] + π^{2}O_{K} = O_{K}.

On repeating these arguments, we find that

ℤ[ζ] + π^{m}O_{K} = O_{K}

for all m ∈ ℕ. Since π^{φ(p^{r})} = p × (unit), this implies that

ℤ[ζ] + p^{m} · O_{K} = O_{K}

for all m ∈ ℕ. But for m large enough, we know that p^{m}O_{K} ⊂ ℤ[ζ], and so it can be dropped from the equation. Hence ℤ[ζ] = O_{K}, and this completes the proof of (b). □

Remark 6.3. (a) The sign of the disc ℚ[ζ]/ℚ), ζ any root of 1, can be computed most easily by using (2.39a). Clearly ℚ[ζ] has no real embeddings, unless ζ = ±1 (and ℚ[ζ] = ℚ), and so, except for this case,

sign(disc(ℚ[ζ]/ℚ)) = (−1)^{s}, s = [ℚ[ζ]: ℚ]/2.

If ζ is a primitive p^{r}th root of 1, p^{r} > 2, then

[ℚ[ζ]: ℚ]/2 = (p − 1)p^{r−1}/2

which is odd if and only if p^{r} = 4 or p ≡ 3 mod 4.

(b) Let ζ and ζ′ be primitive p^{r}th and q^{s}th roots of 1. If p and q are distinct primes, then ℚ[ζ] ∩ ℚ[ζ′] = ℚ, because K ⊂ ℚ[ζ] ⟹ p ramifies totally in K and q does not, and K ⊂ ℚ[ζ′] ⟹ q ramifies totally in K and p does not, and these are contradictory unless K = ℚ.

Theorem 6.4. Let ζ be a primitive n^{th} root of 1.

(a) The field ℚ[ζ] is of degree φ(n) over ℚ.

(b) The ring of integers in ℚ[ζ] is ℤ[ζ].

(c) If p ramifies in ℚ[ζ] then p|n; more precisely, if n = p^{r} · m with m relatively

prime to p, then

(p) = (𝔓_{1} ⋯ 𝔓_{s})^{φ(p^{r})}

in ℚ[ζ] with the 𝔓_{i} distinct primes in ℚ[ζ].

Proof. We use induction on the number of primes dividing n. Write n = p^{r} ·m with m not divisible by p. We may assume the theorem for m. Note that ζ_{p^{r}} =_{df} ζ^{m} is a primitive p^{r}th root of 1, ζ_{m} = ζ^{p^{r}} is a primitive mth root of 1, and that ℚ[ζ] = ℚ[ζ_{p^{r}}] · ℚ[ζ_{m}]. Consider the fields:

ℚ[ζ]
⧸  ⧹
ℚ[ζ_{p^{r}}]  ℚ[ζ_{m}].
⧹  ⧸
ℚ

The prime ideal (p) ramifies totally in ℚ[ζ_{p^{r}}], say (p) = 𝔓^{φ(p^{r})}, but doesn’t ramify in ℚ[ζ_{m}], say (p) = ∏ 𝔓_{i} with the 𝔓_{i} distinct primes. On comparing the factorization of (p) in ℚ[ζ] obtained by going two different ways up the tower, one finds that [ℚ[ζ]: ℚ[ζ_{m}]] = φ(p^{r}), and that (p) = (∏ 𝔔_{i})^{φ(p^{r})}, where

𝔓_{i}O_{ℚ[ζ]} = 𝔔_{i}^{φ(p^{r})}, 𝔓O_{ℚ[ζ]} = ∏ 𝔔_{i}.

Again we are using (3.36). Therefore [ℚ[ζ] : ℚ[ζ_{m}]] = φ(p^{r}), and [ℚ[ζ] : ℚ] = φ(p^{r}) · φ(m) = φ(n). The following lemma completes the proof of the theorem (because it shows that O_{ℚ[ζ]} = ℤ[ζ_{p^{r}}, ζ_{m}] = ℤ[ζ]).

Lemma 6.5. Let K and L be finite extensions of ℚ such that

[KL: ℚ] = [K: ℚ] · [L: ℚ],

and let d = gcd(disc(O_{K}/ℤ), disc(O_{L}/ℤ)). Then

O_{K·L} ⊂ d^{−1}O_{K} · O_{L}.

Proof. Let {α_{1}, ..., α_{m}} and {β_{1}, ..., β_{m}} be integral bases for K and L respectively. Then α_{i}β_{j} is a basis for K ·L over ℚ. Thus every γ ∈ O_{K·L} can be written uniquely in the form

γ = ∑_{ij} \frac{a_{ij}}{r} α_{i}β_{j}, a_{ij}, r ∈ ℤ.

After dividing out any common factors from top and bottom, no prime factor of r will divide all the a_{ij}, and we then have to show that r|d.

Identify L with a subfield of ℂ, and let σ be an embedding of K into ℂ. Then σ extends uniquely to an embedding of K · L into ℂ fixing the elements of L (to see this, write K = ℚ[α]; then K · L = L[α], and the hypothesis on the degrees implies that the minimum polynomial of α doesn’t change when we pass from ℚ to L; there is therefore a unique L-homomorphism L[α] → ℂ sending α to σα). On applying σ to the above equation, we obtain an equation

σ(γ) = ∑_{ij} \frac{a_{ij}}{r} σ(α_{i})β_{j}.

Write x_{i} = ∑_{j}(a_{ij}/r)β_{j}, and let σ_{1}, σ_{2}, ..., σ_{m} be the distinct embeddings of K into ℂ. We obtain a system of m linear equations

∑_{i} σ_{k}(α_{i})x_{i} = σ_{k}(γ), k = 1, 2, ..., m,

and Cramer’s rule tells us that

Dx_{i} = D_{i}

where D = det(σ_{j}(α_{i})) and D_{i} ∈ O_{K·L}. According to (2.25), D^{2} = Δ =_{df} disc(O_{K}/ℤ), and so

Δ · x_{i} = DD_{i} ∈ O_{K·L}.

But Δx_{i} = ∑ \frac{Δa_{ij}}{r} β_{j}, and the β_{j}s form an integral basis for O_{L}, and so \frac{Δa_{ij}}{r} ∈ ℤ. Hence r|Δa_{ij} all i, j, and, because of our assumption on r and the a_{ij}s, this implies that r|Δ.

Similarly, r| disc(O_{L}/ℤ), and so r divides the greatest common divisor of disc(O_{K}/ℤ) and disc(O_{L}/ℤ). □

Remark 6.6. (a) Statement (c) of the theorem shows that if p|n then p ramifies unless φ(p^{r}) = 1. Since φ(p^{r}) = p^{r−1}(p − 1), this can only happen if p^{r} = 2. Thus p|n ⟹ p ramifies in ℚ[ζ_{n}] except when p = 2 and n = 2 · (odd number). Note that ℚ[ζ_{n}] = ℚ[ζ_{2n}] if n is odd.

(b) In the situation of the lemma,

disc(KL/ℚ) = disc(K/ℚ)^{[L: ℚ]} · disc(L/ℚ)^{[K: ℚ]},

provided the discriminants on the right are relatively prime. The example ℚ[i, \sqrt{5}] = ℚ[i] · ℚ[\sqrt{−5}] shows that the condition is necessary, because the extensions have discriminants 4^{2}5^{2}, 4, and 20 respectively. Using this, one can show that, for ζ_{n} a primitive n^{th} root of 1,

disc(ℚ[ζ_{n}]/ℚ) = (−1)^{φ(n)/2}n^{φ(n)}/ ∏_{p|n} p^{φ(n)/(p−1)}.

Class numbers of cyclotomic fields. Let ζ be a primitive p^{th} root of 1, p and odd prime. It is known that the class number of ℚ[ζ] grows quite rapidly with p, and that in fact the class number is 1 if and only if p ≤ 19.

Here is how to prove that ℚ[ζ] has class number > 1 when p = 23. The Galois group of ℚ[ζ] over ℚ is cyclic of order 22, and therefore has a unique subgroup of index 2. Hence ℚ[ζ] contains a unique quadratic extension K of ℚ. Since 23 is the only prime ramifying in ℚ[ζ], it must also be the only prime ramifying in K, and this implies that K = ℚ[\sqrt{−23}]. One checks that (2) splits in ℚ[\sqrt{−23}], say (2) = 𝔭𝔮, that 𝔭 is not principal, and that 𝔭^{3} is principal. Let 𝔓 be a prime ideal of ℤ[ζ] lying over 𝔭. Then N 𝔓 = 𝔭^{f}, where f is the residue class degree. Since f|[ℚ[ζ]: ℚ[\sqrt{−23}]] = 11, we see that f = 1 or 11 (in fact, f = 1). In either case, 𝔭^{f} is not principal, and this implies that 𝔓 is not principal, because the norm of a principal ideal is principal.

Because of the connection to Fermat’s last theorem, primes p such that p does not divide the class number of ℚ[ζ] are of particular interest. They are called regular. Kummer found a simple test for when a prime is regular: define the Bernoulli numbers B_{n} by the formula

\frac{t}{e^{t} − 1} = ∑_{n=0}^{∞} B_{n} \frac{t^{n}}{n!} , B_{n} ∈ ℚ;

then p is regular if and only if p divides the numerator of some B_{k} with k = 2, 4, …, p − 3. It has long between known that (unfortunately) there are infinitely many irregular primes, and it it still not proved that there are infinitely many regular primes (although the first case of Fermat’s theorem is known for infinitely many primes). It is expected that 61% of primes are regular and 39% are irregular.

Units in cyclotomic fields. Let ζ be a primitive n^{th} root of 1, n > 2. Define

ℚ[ζ]^{+} = ℚ[ζ + ζ^{−1}].

For example, if ζ = e^{2πi/n}, then ℚ[ζ]^{+} = ℚ[cos \frac{2π}{n}]. Under any embedding of ℚ[ζ] into ℂ, ζ^{−1} maps to the complex conjugate of ζ, and therefore the image of ℚ[ζ]^{+} is fixed under complex conjugation and hence lies in ℝ. Thus ℚ[ζ]^{+} has φ(n)/2 real embeddings (and no nonreal embeddings), whereas ℚ[ζ]^{+} has φ(n) nonreal complex embeddings. Therefore the unit theorem (5.1) shows that the groups of units in ℚ[ζ] and ℚ[ζ]^{+} have the same rank, and so, if u is a unit in ℚ[ζ], then u^{m} ∈ ℚ[ζ]^{+} for some m. In fact a more precise result is known.

Proposition 6.7. Assume n is a prime power; then every unit u ∈ ℚ[ζ] can be written

u = ζ · v

with ζ a root of unity and v a unit in ℚ[ζ]^{+}.

Proof. This is not difficult—see [Fröhlich and Taylor, VI.1.19] or [Washington]. □

Fermat’s last theorem. Fermat’s last theorem is known to be true for p a regular prime. Here we prove a weaker result, known as the first case of Fermat’s last theorem.

Theorem 6.8. Let p be an odd prime. If the class number of ℚ[ζ] is not divisible by p, then there is no integer solution (x, y, z) to

X^{p} + Y^{p} = Z^{p}

with p ∤ xyz.

Proof. Let (x, y, z) be a solution of Fermat’s equation with p ∤ xyz. After removing any common factor, we may suppose that gcd(x, y, z) = 1.

We first treat the case p = 3. The only cubes modulo 9 are −1, 0, 1, and so

x^{3} + y^{3} ≡ −2, 0, 2 mod 9, z^{3} ≡ −1, 1 mod 9,

which are contradictory. Similarly we may eliminate the case p = 5 by looking modulo 25. Henceforth we assume p > 5.

If x ≡ y ≡ −z mod p, then −2z^{p} ≡ z^{p} and p|3z, contradicting our hypotheses. Hence one of the congruences can’t hold, and after rewriting the equation x^{p} + (−z)^{p} = (−y)^{p} if necessary, we may assume that p ∤ x − y.

The roots of X^{p} + 1 are −1, −ζ, …, −ζ^{p−1}, and so

X^{p} + 1 = ∏_{i=0}^{p−1}(X + ζ^{i}).

Hence

∏_{i=0}^{p−1}(x + ζ^{i}y) = z^{p}.

The idea of the proof is to exploit this factorization and what we know of the arithmetic of ℚ[ζ] to obtain a contradiction.

Let 𝔭 be the unique prime ideal of ℤ[ζ] dividing (p); thus (see 6.2) 𝔭 = (1 − ζ^{i}) for any i, 1 ≤ i ≤ p − 1.

Lemma 6.9. The elements x + ζ^{i}y of ℤ[ζ] are relatively prime in pairs.

Proof. We have to show that there does not exist a prime ideal 𝔮 dividing x+ζ^{i}y and x+ζ^{j}y for i ≠ j. Suppose there does. Then 𝔮|((ζ^{i} −ζ^{j})y) = 𝔭y, and 𝔮|((ζ^{j} −ζ^{i})x) = 𝔭x. By assumption, x and y are relatively prime, and therefore 𝔮 = 𝔭. Thus x+y ≡ x+ζ^{i}y ≡ 0 mod 𝔭. Hence x+y ∈ 𝔭∩ℤ = (p). But z^{p} = x^{p} +y^{p} ≡ x +y ≡ 0 mod p, and so p|z, which contradicts our hypotheses. □

Lemma 6.10. For any α ∈ ℤ[ζ], α^{p} ∈ ℤ + pℤ[ζ].

Proof. Write

α = a_{0} + a_{1}ζ + ⋯ + a_{p−2}ζ^{p−2}, a_{i} ∈ ℤ.

Then

α^{p} ≡ a_{0}^{p} + a_{1}^{p} + ⋯ + a_{p−1}^{p} mod p,

which lies in ℤ. □

Lemma 6.11. Suppose α = a_{0} + a_{1}ζ + ⋯ + a_{p−1}ζ^{p−1} with a_{i} ∈ ℤ and at least one a_{i} = 0. If α is divisible by an integer n, i.e., if α ∈ nℤ[ζ], then each a_{i} is divisible by n.

Proof. Since 1+ζ +⋯+ζ^{p−1} = 0, any subset of {1, ζ, …, ζ^{p−1}} with p−2 elements will be a ℤ-basis for ℤ[ζ]. The result is now obvious. □

We can now complete the proof of the Theorem. Consider the equation

∏_{i=0}^{p−1}(x + ζ^{i}y) = (z)^{p}

as an equality of ideals in ℤ[ζ]. Since the factors on the left are relatively prime in pairs, each one must be the p^{th} power of an ideal, say

(x + ζ^{i}y) = 𝔞_{i}^{p}

for some ideal 𝔞_{i} in ℤ[ζ]. This equation says 𝔞_{i} has order dividing p in the class group, but we are assuming that the class group of ℤ[ζ] is of order prime to p, and so 𝔞_{i} itself is principal, say 𝔞_{i} = (α_{i}).

Take i = 1, and omit subscripts. Then we have that x + ζy = uα^{p} for some unit u in ℤ[ζ]. We apply (6.7) to write u = ζ^{r}v where v̄ = v. According to (6.10), there is an a ∈ ℤ such that α^{p} ≡ a mod p. Therefore

x + ζy = ζ^{r}vα^{p} ≡ ζ^{r}va mod p.

Also

x + ζ̄y = ζ^{−r}vᾱ^{p} ≡ ζ^{−r}va mod p.

On combining these statements, we find that

ζ^{−r}(x + ζy) ≡ ζ^{r}(x + ζ^{−1}y) mod p,

or

x + ζy − ζ^{2r}x − ζ^{2r−1}y ≡ 0 mod p.  (*)

If 1, ζ, ζ^{2r−1}, ζ^{2r} are distinct, then, because p ≥ 5, Lemma 6.11 implies that p divides x and y, which is contrary to our original assumption. The only remaining possibilities are:

(a) 1 = ζ^{2r}; but then (*) says

ζy − ζ^{−1}y ≡ 0 mod p,

and Lemma 6.11 implies p|y, which contradicts our original assumption.

(b) 1 = ζ^{2r−1}; then ζ = ζ^{2r}, and (*) says

(x − y) − (x − y)ζ ≡ 0 mod p,

and Lemma 6.11 implies that p|x − y, which contradicts the choice of x and y made at the start of the proof.

(c) ζ = ζ^{2r−1}; but then (*) says

x − ζ^{2}x ≡ 0 mod p,

and Lemma 6.11 implies that p|x, which contradicts our original assumption. This completes the proof. □

Additional reference. Washington, L., Introduction to Cyclotomic Fields, 1982.

This is the best book on cyclotomic fields.

§7. Valuations; Local Fields

In this section, we define the notion of a valuation and study the completions of number fields with respect to valuations.

Valuations. A (multiplicative) valuation on a field K is a function x ↦ |x|: K → ℝ such that

(a) |x| > 0 except that |0| = 0;

(b) |xy| = |x||y|

(c) |x + y| ≤ |x| + |y| (triangle inequality). If the stronger condition

(c′) |x + y| ≤ max{|x|, |y|} holds, then | | is called a nonarchimedean valuation.

Note that (a) and (b) imply that | | is a homomorphism K^{×} → ℝ_{>0} (multiplicative group of positive real numbers). Since ℝ_{>0} is torsion-free, | | maps all roots of unity in K^{×} to 1. In particular, | − 1| = 1, and | − x| = |x| for all x.

Example 7.1. (a) For any number field K, and embedding σ: K ↪ ℂ, we get a valuation on K by putting |a| = |σa|.

(b) Let ord: K^{×} → ℤ be an (additive) discrete valuation, and let e be a real number with e > 1; then

|a| = (1/e)^{ord(a)}, a ≠ 0, |0| = 0

is a nonarchimedean valuation on K. For example, for any prime number p, we have the p-adic valuation | |_{p} on ℚ :

|a|_{p} = (1/e)^{ord_{p}(a)}.

Usually we normalize this by taking e = p; thus

|a|_{p} = (1/p)^{ord_{p}(a)} = 1/p^{r} if a = a_{0} · p^{r} with ord_{p}(a_{0}) = 0.

Similarly, for any prime ideal 𝔭 in a number field K, we have a normalized 𝔭-adic valuation

|a|_{𝔭} = (1/e)^{ord_{𝔭}(a)}.

(c) On any field we can define the trivial valuation: |a| = 1 for all a ≠ 0. When K is finite, there is no other (because all nonzero elements of a finite field are roots of 1).

Nonarchimedean valuations. Recall that this means that, instead of the triangle inequality, we have

|x + y| ≤ max{|x|, |y|}.

By induction, this condition implies that

| ∑ x_{i}| ≤ max{|x_{i}|}.  (*)

Proposition 7.2. A valuation | | is nonarchimedean if and only if it takes bounded values on {m1 | m ∈ ℤ}.

Proof. If | | is nonarchimedean, then, for m > 0,

|m1| = |1 + 1 + ⋯ + 1| ≤ |1| = 1.

As we noted above, | − 1| = |1|, and so | − m1| = |m1| = 1.

Conversely, suppose |m1| ≤ N for all m. Then

|x + y|^{n} = | ∑ \binom{n}{r}x^{r}y^{n−r} | ≤ ∑_{r} |\binom{n}{r}| |x|^{r}|y|^{n−r}.

Clearly |x|^{r}|y|^{n−r} ≤ max\{|x|^{n}, |y| = max\{|x|, |y|\}^{n} and \binom{n}{r} is an integer, and so

|x + y|^{n} ≤ N(n + 1) max{|x|, |y|}^{n}.

On taking n^{th} roots we find that

|x + y| ≤ N^{1/n}(n + 1)^{1/n} max{|x|, |y|}.

When we let n → ∞, the terms involving n tend to 1 (to see this, take logs). □

Corollary 7.3. If char K ≠ 0, then K has only nonarchimedean valuations.

Proof. In this case, the set {m · 1 | m ∈ ℤ} is finite. □

Aside 7.4. The classical archimedean axiom states that if a and b are nonzero elements of K, then there is an n ∈ ℕ such that |b| < |na|. The proposition shows that the nonarchimedean valuations are precisely those for which the archimedean axiom fails, whence the name.

As we noted above, a discrete (additive) valuation ord on K determines a valuation by

|x| = e^{− ord(x)},

any e > 1. Taking logs gives log_{e} |x| = − ord(x), or ord(x) = − log_{e} |x|. This suggests how we might pass from multiplicative valuations to additive valuations.

Proposition 7.5. Let | | be a nontrivial nonarchimedean valuation, and put v(x) = − log |x|, x ≠ 0 (log to base e for any real e > 1). Then v: K^{×} → ℝ satisfies the following conditions:

(a) v(xy) = v(x) + v(y);

(b) v(x + y) ≥ min{v(x), v(y)}. If v(K^{×}) is a discrete in ℝ, then it is a multiple of a discrete valuation ord: K^{×} ↠ ℤ ⊂ ℝ.

Proof. That v satisfies (a) and (b) is obvious. For the last statement, note that v(K^{×}) is a subgroup of ℝ (under addition). If it is a discrete subgroup, then it is a lattice (by 4.14), which means that v(K^{×}) = ℤc for some c. Now ord =_{df} c^{−1} · v is an additive discrete valuation K^{×} ↠ ℤ. □

We shall say | | is discrete when |K^{×}| is a discrete subgroup of ℝ_{>0}. Note that, even when |K^{×}| is discrete in ℝ, |K| usually won’t be, because 0 will be a limit point for the set |K^{×}|. For example, |p^{n}|_{p} = p^{−n}, which converges to 0 as n → ∞.

Proposition 7.6. Let | | be a nonarchimedean valuation. Then A =_{df} {a ∈ K | |a| ≤ 1} is a subring of K, with U =_{df} {a ∈ K | |a| = 1} as its group of units, and 𝔪 =_{df} {a ∈ K | |a| < 1} as its unique maximal ideal.

The valuation | | is discrete if and only if 𝔪 is principal, in which case A is a discrete valuation ring.

Proof. The first assertion is obvious. If | | is discrete, then A and 𝔪 are the pair associated (as in 3.28) with the additive valuation − log | |, and so A is a discrete valuation ring and 𝔪 is generated by any element π ∈ K^{×} such |π| is the largest element of |K^{×}| less than one. Conversely, if 𝔪 = (π), then |K^{×}| is the subgroup of ℝ_{>0} generated by |π|. □

Remark 7.7. There do exist nondiscrete nonarchimedean valuations. For example, let ℚ^{al} be an algebraic closure of ℚ. We shall see later that the p-adic valuation | |_{p}: ℚ → ℝ extends to ℚ^{al} (in many different ways). Since ℚ^{al} contains an element p^{1/n} for all n, we see that |ℚ^{al×}| ∋ (p^{−1})^{1/n} = 1/ \sqrt[n]{p} for all n, and 1/ \sqrt[n]{p} → 1 as n → ∞. In fact, one can show that |ℚ^{al×}| = {p^{r} | r ∈ ℚ}, which is not discrete in ℝ_{>0}.

Equivalent valuations. Note that a valuation | | defines a metric on K, with distance function

d(a, b) = |a − b|,

and hence a topology on K. In more detail, for a ∈ K, the sets

U(a, ε) = {x ∈ K | |x − a| < ε}, ε > 0,

form a fundamental system of open neighbourhoods of a. A set is open if and only if it is a union of sets of the form U(a, ε).

For example, for the topology on ℚ defined by | |_{p}, a and b are close if their difference is divisible by a high power of p. In particular, the sequence

1, p, p^{2}, …, p^{n}, …

converges to 0.

The topology defined by the 𝔭-adic valuation | |_{𝔭} is called the 𝔭-adic topology on K.

Proposition 7.8. Let | |_{1}, | |_{2} be valuations on K, with | |_{1} nontrivial. The following conditions are equivalent:

(a) | |_{1}, | |_{2} define the same topology on K;

(b) |α|_{1} < 1 ⟹ |α|_{2} < 1;

(c) | |_{2} = | |_{1}^{a} for some a > 0.

Proof. (a) ⟹ (b): Since |α^{n}| = |α|^{n}, clearly α^{n} → 0 if and only if |α| < 1. Therefore (a) implies that

|α|_{1} < 1 ⟺ |α|_{2} < 1.

(b) ⟹ (c): Because | |_{1} is nontrivial, there exists a y ∈ K such that |y| > 1. Let

a = log |y|_{2}/ log |y|_{1},

so that

log |y|_{2} = a · log |y|_{1},

or

|y|_{2} = |y|_{1}^{a}.

Now let x be any nonzero element of K. There is a real number b such that

|x|_{1} = |y|_{1}^{b}.

To prove (c), it suffices to prove that

|x|_{2} = |y|_{2}^{b},

because then

|x|_{2} = |y|_{2}^{b} = |y|_{1}^{ab} = |x|_{1}^{a}.

Let m/n, n > 0, be a rational number > b. Then

|x|_{1} = |y|_{1}^{b} < |y|1^{\frac{m}{n}}

and so

|x^{n}/y^{m}|_{1} < 1.

From our assumption (b), this implies that

|x^{n}/y^{m}|_{2} < 1

and so

|x|_{2} < |y|2^{\frac{m}{n}} .

This is true for all rational numbers \frac{m}{n} > b, and so

|x|_{2} ≤ |y|_{2}^{b}.

A similar argument with rational numbers \frac{m}{n} < b shows that

|x|_{2} ≥ |y|_{2}^{b},

and so we have equality, which completes the proof of (a). □

Two valuations are said to be equivalent if they satisfy the conditions of the proposition.

Properties of discrete valuations. We make some easy, but important, observations about discrete valuations.

(7.9.1) For an additive valuation, we are given that

ord(a + b) ≥ min{ord(a), ord(b)}

and we checked (p51) that this implies that equality holds if ord(a) ≠ ord(b). For multiplicative valuations, we are given that

|a + b| ≤ max{|a|, |b|},

and a similar argument shows that equality holds if |a| ≠ |b|. This has the following consequences.

(7.9.2) Recall that we define a metric on K by setting d(a, b) = |a − b|. I claim that if x is closer to b than it is to a, then d(a, x) = d(a, b). For we are given that

|x − b| < |x − a|,

and this implies that

|b − a| = |b − x + x − a| = |x − a|.

(7.9.3) Suppose

a_{1} + a_{2} + ⋯ + a_{n} = 0.

Then an argument as on p62 shows that the maximum value of the summands must be attained for at least two values of the subscript.

Complete list of valuations for ℚ. We now give a complete list of the valuations on ℚ (up to equivalence). We write | |_{∞} for the valuation on ℚ defined by the usual absolute value on ℝ, and we say that | |_{∞} is normalized.

Theorem 7.10. (Ostrowksi) Let | | be a nontrivial valuation on ℚ.

(a) If | | is archimedean, then | | is equivalent to | |_{∞}.

(b) If | | is nonarchimedean, then it is equivalent to | |_{p} for exactly one prime p.

Proof. Let m, n be integers > 1. Then we can write

m = a_{0} + a_{1}n + ⋯ + a_{r}n^{r}

with the a_{i} integers, 0 ≤ a_{i} < n, n^{r} ≤ m. Let N = max{1, |n|}. By the triangle inequality,

|m| ≤ ∑ |a_{i}||n|^{i} ≤ ∑ |a_{i}|N^{r}.

We know

r ≤ log(m)/ log(n),

(log relative to some e > 1) and the triangle inequality shows that

|a_{i}| ≤ |1 + ⋯ + 1| = a_{i}|1| = a_{i} ≤ n.

On putting these into the first inequality, we find that

|m| ≤ (1 + r)nN^{r} ≤ (1 + \frac{log m}{log n})nN^{\frac{log m}{log n}} .

In this inequality, replace m with m^{t} (t an integer), and take t^{th} roots:

|m| ≤ (1 + \frac{t log m}{log n})^{\frac{1}{t}} n^{\frac{1}{t}} N^{\frac{log m}{log n}} .

Now let t → ∞. The terms involving t tend to 1, and so

|m| ≤ N^{\frac{log m}{log n}} .  (*)

Case (i): For all integers n > 1, |n| > 1.

In this case N = |n|, and (*) yields:

|m|^{1/ log m} ≤ |n|^{1/ log n}.

By symmetry, we must have equality, and so there is an c > 1 such that

c = |m|^{1/ log m} = |n|^{1/ log n}

for all integers m, n > 1. Hence

|n| = c^{log n} = e^{log c log n} = n^{log c}, all integers n > 1.

Let a = log c, and rewrite this

|n| = |n|_{∞}^{a}, all integers n > 1,

where | |_{∞} is the usual absolute value on ℚ. Since both | | and | |_{∞}^{a} are homomorphisms ℚ^{×} → ℝ_{>0}, the fact that they agree on a set of generators for the group ℚ^{×} (the primes and −1) implies that they agree on all of ℚ^{×}.

Case (ii): For some n > 1, |n| ≤ 1.

In this case, N = 1, and (*) implies |m| ≤ 1 for all integers m. Therefore the valuation is nonarchimedean. Let A be the associated local ring and 𝔪 its maximal ideal. From the definition of A, we know that ℤ ⊂ A. Then 𝔪 ∩ ℤ is a prime ideal in ℤ (because 𝔪 is a prime ideal), and it is nonzero for otherwise the valuation would be trivial. Hence 𝔪 ∩ ℤ = (p) for some p. This implies that |m| = 1 if m is an integer not divisible by p, and so |np^{r}| = |p|^{r} if n is a rational number whose numerator and denominator are not divisible by p. If a is such that |p| = (1/p)^{a}; then |x| = |x|_{p}^{a} for all x ∈ ℚ. □

Theorem 7.11. (The product formula). For p = 2, 3, 5, 7, ..., ∞, let | |_{p} be the corresponding normalized valuation on ℚ. For any nonzero rational number a

∏ |a|_{p} = 1 (product over all p including ∞).

Proof. Let α = a/b, a, b ∈ ℤ. Then |α|_{p} = 1 unless p|a or p|b. Therefore |α|_{v} = 1 for all but finite many vs, and so the product is really finite.

Let π(a) = ∏ |a|_{v}. Then π is a homomorphism ℚ^{×} → ℝ^{×}, and so it suffices to show that π(−1) = 1 and π(p) = 1 for each prime number p. The first is obvious, because | − 1| = 1 for all valuations | |. For the second, note that

|p|_{p} = 1/p, |p|_{q} = 1, q a prime ≠ p, |p|_{∞} = p.

The product of these numbers is 1. □

The primes of a number field. Let K be an algebraic number field. An equivalence class of valuations on K is called a prime of K.

Theorem 7.12. Let K be an algebraic number field. There exists exactly one prime of K

(a) for each prime ideal 𝔭;

(b) for each real embedding;

(c) for each conjugate pair of complex embeddings.

Proof. See §8. □

In each equivalence class of valuations of K we select a normalized valuation as follows:

for a prime ideal 𝔭 of O_{K}, |a|_{𝔭} = (1/ℕ𝔭)^{ord_{𝔭}(a)} = (O_{𝔭} : (a));

for a real embedding σ: K ↪ ℝ, |a| = |σa|;

for a nonreal complex embedding σ: K ↪ ℂ, |a| = |σa|^{2}. Note that this last is not actually a valuation, because it doesn’t satisfy the triangle law. There are various ways of getting around this problem—the best is simply to ignore it.

Notations. We generally write v for a prime. If it corresponds to a prime ideal 𝔭 of O_{K}, then we call it a finite prime, and we write 𝔭_{v} for the ideal. If it corresponds to a (real or nonreal) embedding of K, then we call it an infinite (real or complex) prime. We write | |_{v} for a valuation in the equivalence class. If L ⊃ K and w and v are primes of L and K such that | |_{w} restricted to K is equivalent to | |_{v}, then we say that w divides v, or w lies over v, and we write w|v. For a finite prime, this means 𝔓_{w} ∩ O_{K} = 𝔭_{v} or, equivalently, that 𝔓_{w} divides 𝔭_{v} · O_{L}. For an infinite prime, it means that w corresponds to an embedding σ: L ↪ ℂ that extends the embedding corresponding to v (or its complex conjugate).

Theorem 7.13. (Product formula). For each prime v, let | |_{v} be the normalized valuation. For any nonzero α ∈ K,

∏ |α|_{v} = 1 (product over all primes of K).

Proof. The product formula for a general number field follows from the product formula for ℚ and the next result. □

Lemma 7.14. Let L be a finite extension of a number field K.

(a) Each prime on K extends to a finite number of primes of L.

(b) For any prime v of K and α ∈ L^{×},

∏_{w|v} |α|_{w} = | Nm_{L/K} α|_{v}.

Proof. See §8. □

Remark 7.15. The product formula is true in two other important situations.

(a) Let K be a finite extension of k(T) where k is a finite field. According to (7.3), the valuations of K are all discrete, and hence correspond to discrete valuation rings in K. As in the number field case, we can normalize a valuation by setting |a|_{v} = (1/ℕv)^{ord_{v}(a)} where ℕv is the number of elements in the residue field of the discrete valuation ring and ord_{v}: K^{×} ↠ ℤ. Then ∏_{v} |a|_{v} = 1. The proof of this is easy when K = k(T), and the general case is obtained by means of a result like (7.14).

(b) Let K be a finite extension of k(T) where k is an algebraically closed field. In this case we only look at primes that are trivial when restricted to k. All such primes are nonarchimedean, and hence correspond to discrete valuations ord_{v}: K^{×} ↠ ℤ. Fix an e > 1, and define |a|_{v} = (1/e)^{ord_{v}(a)} for every v. Then ∏ |a|_{v} = 1 for all a ∈ K^{×}. This of course is equivalent to the statement

∑ ord_{v}(a) = 0.

For example, let X be a compact Riemann surface, and let K be the field of meromorphic functions on X. For each point P of X we have a discrete valuation, defined by ord_{P} (f) = m or −m according as f has a zero or pole of order m at P. The valuations ord_{P} are precisely the valuations on K trivial on ℂ ⊂ K, and so the product formula for K is simply the statement that f has as many zeros as poles.

The proof of this runs as follows: the Cauchy integral formula implies that if f is a nonconstant meromorphic function on an open set U in ℂ, and Γ is the oriented boundary of a compact set C contained in U, then

∫_{Γ} \frac{f′(z)}{f(z)}dz = 2πi(Z − P)

where Z is the number of zeros of f in C and P is the number of poles of f, both counted with multiplicities. This formula also holds for compact subsets of manifolds. If the manifold M is itself compact, then we can take C = M, which has no boundary, and so the formula becomes

Z − P = 0,

i.e.,

∑ ord_{P} (f) = 0, P ∈ M.

Completions. Let K be a field with a nontrivial valuation. A sequence (a_{n}) of elements in K is called a Cauchy sequence if, for all ε > 0, there is an N such that

|a_{n} − a_{m}| < ε, all m, n > N.

The field K is said to be complete if every Cauchy sequence has a limit in K. (The limit is necessarily unique.)

Example 7.16. Consider the sequence in ℤ

4, 34, 334, 3334, ......

As

|a_{m} − a_{n}|_{5} = 5^{−n} (m > n),

this is a Cauchy sequence. Note that

3 · 4 = 12, 3 · 34 = 102, 3 · 334 = 1002, 3 · 3334 = 10002, ......

and so 3 · a_{n} − 2 → 0 as n → ∞. Thus lim_{n→∞} a_{n} = 2/3 ∈ ℚ.

There is a similar notion of Cauchy series. For example, any series of the form

a_{−n}p^{−n} + ⋯ + a_{0} + a_{1}p + ⋯ + a_{m}p^{m} + ⋯, 0 ≤ a_{i} < p,

is a Cauchy series in ℚ for the p-adic topology.

Theorem 7.17. Let K be a field with a valuation | |. Then there exists a complete valued field (K̂, | |) and a homomorphism K → K̂ preserving the valuation that is universal in the following sense: any homomorphism K → L from K into a complete valued field (L, | |) preserving the valuation, extends uniquely to a homomorphism K̂ → L. The image of K in K̂ is dense.

Proof. (Sketch) The uniqueness of (K̂, | |) is obvious from the universal property. Let K̄ be the closure of K in K̂; then K̄ is complete, and so must be all of K̂. Therefore K is dense in K̂.

It remains to construct K̂. Every point of K̂ will be the limit of a sequence of points in K, and the sequence will be Cauchy. Two Cauchy sequences will converge to the same point in K̂ if and only if they are equivalent in the sense that

lim_{n→∞} |a_{n} − b_{n}| = 0.

This suggests defining K̂ to be the set of equivalence classes of Cauchy sequences in K. Define addition and multiplication of Cauchy sequences in the obvious way, and verify that K̂ is a field. There is a canonical map K → K̂ sending a to the constant Cauchy sequence a, a, a, …, which we use to identify K with a subfield of K̂. We can extend a homomorphism from K into a second complete valued field L to K̂ by mapping the limit of a Cauchy sequence in K̂ to its limit in L. □

For a prime v of K, we write K_{v} for the completion of K with respect to K_{v}. When v corresponds to a prime ideal 𝔭, we write K_{𝔭} for the completion, and Ô_{𝔭} for the ring of integers in K_{𝔭}. For example, ℚ_{p} is the completion of ℚ with respect to the p-adic valuation | |_{p}. We write ℤ_{p} (not ℤ̂_{p}) for the ring of integers in ℚ_{p} (the ring of p-adic integers).

Completions in the nonarchimedean case. Let | | be a discrete nonarchimedean valuation on K, and let π be an element of K with largest value < 1 (therefore π generates the maximal ideal 𝔪 in the valuation ring A). Such a π is called a local uniformizing parameter.

The set of values is

|K| = {c^{m} | m ∈ ℤ} ∪ {0}, c = |π|.

Let a ∈ K̂^{×}, and let a_{n} be a sequence in K converging to a. Then |a_{n}| → |a| (because | | is a continuous map), and so |a| is a limit point for the set |K^{×}|. But |K^{×}| is closed (being discrete), and so |a| ∈ |K^{×}|. Thus |K̂| = |K|, and so | | is a discrete valuation on K̂ also. Let ord: K^{×} ↠ ℤ be a normalized discrete additive valuation corresponding to | |; then ord extends to a normalized discrete valuation on K̂.

Note that if a_{n} → a ≠ 0, then |a_{n}| → |a| ≠ 0, and (because |K^{×}| is discrete), |a_{n}| = |a| for all n large enough.

The ring associated with | | in K̂ is

Â = {a ∈ K̂ | |a| ≤ 1}.

Clearly Â is the set of limits of Cauchy sequences in A, and it is therefore the closure of A in K̂. The maximal ideal in Â is

𝔪̂ = {a ∈ K̂ | |a| < 1}.

Again it is the set of limits of Cauchy sequences in 𝔪, and so it is the closure of 𝔪. Similarly, 𝔪̂^{n} is the closure of 𝔪^{n}. Let π be an element with ord(π) = 1; then π generates 𝔪 in A and 𝔪̂ in Â.

Lemma 7.18. For any n, the map A/𝔪^{n} → Â/𝔪̂^{n} is an isomorphism.

Proof. Note that

𝔪^{n} = {a ∈ A | |a| ≤ |π|^{n}} = {a ∈ A | |a| < |π|^{n−1}}

is both open and closed in A. Because it is closed, the map is injective; because 𝔪̂^{n} is open, the map is surjective. □

Proposition 7.19. Choose a set S of representatives for A/𝔪, and let π generate 𝔪. The series

a_{−n}π^{−n} + ⋯ + a_{0} + a_{1}π + ⋯ + a_{m}π^{m} + ⋯, a_{i} ∈ S

is a Cauchy series, and every Cauchy series is equivalent to exactly one of this form. Thus each element of K̂ has a unique representative of this form.

Proof. Let s_{M} = ∑_{i=−n}^{M} a_{i}π^{i}. Then

|s_{M} − s_{N}| ≤ |π|^{M+1}, if M < N,

which shows that the sequence s_{M} is Cauchy. Let α ∈ K̂. Because |K̂| = |K|, we can write α = π^{n}α_{0} with α_{0} a unit in Â. From the definition of S, we see that there exists an a_{0} ∈ S such that α_{0} − a_{0} ∈ 𝔪̂. Now \frac{α_{0}−a_{0}}{π} ∈ Â, and so there exists an a_{1} ∈ S such that \frac{α_{0}−a_{0}}{π} − a_{1} ∈ 𝔪̂. Now there exists an a_{2} such that \frac{α_{0}−a_{0}−a_{1}π}{π} − a_{2} ∈ 𝔪̂, etc. In the limit,

α_{0} = a_{0} + a_{1}π + ⋯, α = π^{n}α_{0}.

Note that

| ∑ a_{i}π^{i}| = |π^{m}|

if a_{m} is the first nonzero coefficient. Therefore ∑ a_{i}π^{i} = 0 (if and) only if a_{i} = 0 for all i. This proves the uniqueness. □

Thus, for example, every equivalence class of Cauchy sequences in ℚ for | |_{p} has a unique representative of the form

a_{−n}p^{−n} + ⋯ + a_{0} + a_{1}p + a_{2}p^{2} + ⋯, 0 ≤ a_{i} < p.

Note that the partial sums of such a series are integers. It is as easy to work with such series as with decimal expansions of real numbers—just remember high powers of p are small, and hence the first to be ignored.

We explain this in more detail. The maps

ℤ/(p^{n}) → ℤ_{(p)}/(p^{n}) → ℤ_{p}/(p^{n})

are both bijective (see 3.11 for the first map). Let α ∈ ℤ_{p}. Because the map is bijective, for all n, there is an a_{n} ∈ ℤ such that α ≡ a_{n} mod p^{n}. Note that, if n < m, a_{n} ≡ a_{m} mod p^{n}, which implies that (a_{n}) is a Cauchy sequence. Let

a_{n} ≡ c_{0} + c_{1}p + ⋯ + c_{n−1}p^{n−1} mod p^{n}, 0 ≤ c_{i} < p − 1;

then

α = ∑_{i≥0} c_{i}p^{i}.

Conversely, if α = ∑ c_{i}p^{i}, 0 ≤ c_{i} < p − 1, then c_{0}, c_{1}, … is the unique sequence of integers, 0 ≤ c_{i} ≤ p − 1, such that

α ≡ ∑_{i=0}^{n−1} c_{i}p^{i} mod p^{n}.

If α ∈ ℚ_{p} but not ℤ_{p}, then p^{m}α ∈ ℤ_{p} for a sufficiently large m, and the above arguments can be applied to it.

Example 7.20. To illustrate how to work with p-adic numbers, I prove that -1 is a square in ℚ_{5}. We have to find a series

a_{0} + a_{1}5 + a_{2}5^{2} + ⋯, a_{i} = 0, 1, 2, 3, or 4

such that

(a_{0} + a_{1}5 + a_{2}5^{2} + ...)^{2} + 1 = 0.

We first need that

a_{0}^{2} + 1 ≡ 0 mod 5.

Thus we must take a_{0} = 2 or 3; we choose 2 (choosing 3 would lead to the other root). Next we need

(2 + a_{1}5)^{2} + 1 ≡ 0 mod 5^{2},

and so we want

5 + 20a_{1} ≡ 0 (mod 5^{2}).

We must take a_{1} = 1. Suppose we have found

c_{n} = a_{0} + a_{1}5 + a_{2}5^{2} + ⋯ + a_{n}5^{n}

such that

c_{n}^{2} + 1 ≡ 0 (mod 5^{n+1}),

and consider c_{n} + a_{n+1}5^{n+1}. We want

(c_{n} + a_{n+1}5^{n+1})^{2} + 1 ≡ 0 (mod 5^{n+2}),

for which we need that

c_{n}^{2} + 1 + 2c_{n}a_{n+1}5^{n+1} ≡ 0 (mod 5^{n+2}),

or that

2c_{n}a_{n}5^{n+1} ≡ (−1 − c_{n}^{2}) (mod 5^{n+2}),

or that

2c_{n}a_{n} ≡ (−1 − c_{n}^{2})/5^{n+1} (mod 5),

or that

4a_{n} = (−1 − c_{n}^{2})/5^{n+1} (mod 5).

Since 4 is invertible modulo 5, we can always achieve this. Hence we obtain a series converging to -1.

There is a leisurely, and very detailed, discussion of ℚ_{p} in the first chapter of N. Koblitz, p-adic Numbers, p-adic Analysis, and Zeta-Functions.

Aside 7.21. Those who have taken a course in commutative algebra will know another method of completing a local ring R, namely

R′ = lim_{←} R/𝔪^{n} = {(a_{n}) | a_{n} ∈ R/𝔪^{n}, a_{n+1} ≡ a_{n} mod 𝔪^{n}}.

In the case that R is a discrete valuation ring, this definition agrees with the above. There is an injective homomorphism

R → R′, a ↦ (a_{n}), a_{n} = a mod π^{n}.

We can define a homomorphism R′ → R̂ as follows: let (a_{n}) ∈ R′, and choose a representative a′_{n} for a_{n} in R; then (a′_{n}) is an Cauchy sequence whose equivalence class is independent of the choices of the a′_{n}, and we can map (a_{n}) to (a′_{n}). It is easy to see that the map R′ → R̂ is surjective, and it follows that it is an isomorphism.

Newton’s lemma. The argument in the above example works much more generally. Let f(X) = X^{2} + 1. Then all we in fact used was that f(X) has a simple root modulo 5.

In the rest of this subsection, A is a complete discrete valuation ring and π generates its maximal ideal (unless we say otherwise).

Proposition 7.22. Let f(X) ∈ A[X], and let a_{0} be a simple root of f(X) mod π. Then there is a unique root a of f(X) with a ≡ a_{0} mod π.

Proof. Suppose we have found a_{n} ≡ a_{0} mod p such that

f(a_{n}) ≡ 0 mod π^{n+1}.

Let a_{n+1} = a_{n} + hπ^{n+1}, h ∈ A. We want

f(a_{n} + hπ^{n+1}) ≡ 0 mod π^{n+2}.

Recall (trivial Taylor’s expansion) that, for any polynomial f,

f(c + t) = f(c) + t · f′(c) + ⋯

where f′(X) is the formal derivative of f(X). Then

f(a_{n} + hπ^{n+1}) = f(a_{n}) + hπ^{n+1} · f′(a_{n}) + ⋯,

which we want ≡ 0 mod π^{n+2}. Hence we must take h so that

h = −\frac{f(a_{n})}{π^{n+1}} · f′(a_{n})^{−1} mod π.

This is possible because π^{n}|f(a_{n}) and

f′(a_{n}) ≡ f′(a_{0}) mod π,

which is nonzero, and hence invertible, mod π. □

There is a stronger form of the proposition. Recall Newton’s approximation method for finding a solution to f(x) = 0, where f is a function of a real variable. Starting from an a_{0} such that f(a_{0}) is small, define a sequence a_{1}, a_{2}, ... by putting

a_{n+1} = a_{n} − f(a_{n})/f′(a_{n}).

Often a_{n} converges to a root of f(x). In the above proof, this is what we did, but the same argument can be made to work more generally.

Theorem 7.23. (Newton’s lemma). Let f(X) ∈ A[X]. Let a_{0} ∈ A satisfy

|f(a_{0})| < |f′(a_{0})|^{2}.

Then there is a unique root a of f(X) such that

|a − a_{0}| ≤ |\frac{f(a_{0})}{f′(a_{0})^{2}} | .

Proof. Define a sequence a_{0}, a_{1}, … by setting

a_{n+1} = a_{n} − \frac{f(a_{n})}{f′(a_{n})}

and prove that it is a Cauchy sequence converging to a root of f(X). See for example (Lang, Algebraic Number Theory, p42). [In fact, it is not necessary to assume that | | is discrete.] □

Proposition 7.22 shows that a simple factor of degree 1 of f(X) mod π lifts to a factor of f(X). This generalizes.

Theorem 7.24. (Hensel’s lemma). Let k be the residue field of A; for f(X) ∈ A[X], write f̄(X) for the image of f in k[X]. Consider a monic polynomial f(X) ∈ A[X]. If f̄(X) factors as f̄ = g_{0}h_{0} with g_{0} and h_{0} monic and relatively prime (in k[X]), then f itself factors as f = gh with g and h monic and such that ḡ = g_{0} and h̄ = h_{0}. Moreover, g and h are uniquely determined, and (g, h) = A[X].

Proof. We first prove that (g, h) = A[X] (such a pair is said to be strictly coprime; in k[X] strictly coprime just means coprime, i.e., relatively prime).

Lemma 7.25. Let A be a local ring with residue field k. If f, g ∈ A[X] are such that f̄ and ḡ are relatively prime and f is monic, then (f, g) = A[X].

Proof. Let M = A[X]/(f, g). As f is monic, this is a finitely generated A-module. As (f̄, ḡ) = k[X], we have that (f, g) + 𝔪A[X] = A[X] and so 𝔪M = M. Now Nakayama’s lemma (1.3) implies that M = 0. □

Lemma 7.26. Let A be a local ring with residue field k. Suppose f = gh = g′h′ with g, h, g′, h′ all monic, and ḡ = ḡ′, h̄ = h̄′ with ḡ and h̄ relatively prime. Then g = g′ and h = h′.

Proof. From the preceding lemma we know that (g, h′) = A[X], and so there exist r, s ∈ A[X] such that gr + h′s = 1. Now

g′ = g′gr + g′h′s = g′gr + ghs,

and so g divides g′. As both are monic and have the same degree, they must be equal. □

We now prove the existence of g and h. We are given that there exist monic polynomials g_{0}, h_{0} ∈ A[X] such that

f − g_{0}h_{0} ≡ π · A[X].

Suppose we have constructed monic polynomials g_{n}, h_{n} such that

f − g_{n}h_{n} ≡ 0 mod π^{n+1}A[X]

and g_{n} ≡ g_{0}, h_{n} ≡ h_{0} mod πA[X]. We want to find u, v ∈ A[X] such that

f − (g_{n} + π^{n+1}u)(h_{n} + π^{n+1}v) ≡ 0 mod π^{n+2}A[X],

i.e., we want

(f − g_{n}h_{n}) − π^{n+1}(uh_{n} + g_{n}v) ≡ 0 mod π^{n+2}A[X].

Thus we are looking for polynomials u, v in A[X] such that

uh_{n} + g_{n}v ≡ (f − g_{n}h_{n})/π^{n+1} mod πA[X].

[[Check degrees of u, v O.K..]] From (7.25), we know that h_{n} and g_{n} are strictly coprime, and so we can always find such polynomials u, v. □

Remark 7.27. By induction, the theorem shows that a factorization of f into a product of relatively prime polynomials in k[X] lifts to a factorization in A[X]. For example, in 𝔽_{p}[X], X^{p} − X splits into p distinct factors, and so it also splits in ℤ_{p}[X]. Hence ℤ_{p} contains the p − 1^{st} roots of 1. More generally, if K has a residue field k with q elements, then K contains q roots of the polynomial X^{q} − X. Let S be the set of these roots. Then

a ↦ ā: S → k,

is a bijection preserving multiplication (but not, of course, addition) – the elements of S are called the Teichmüller representatives for the elements of the residue field.

Remark 7.28. Theorems 7.23 and 7.24 are both stonger versions of 7.22. There is in fact a stronger version of 7.23. For a polynomial h = ∑ c_{i}X^{i}, define

∥h∥ = max |c_{i}|.

Let

f(X) = a_{n}X^{n} + a_{n−1}X^{n−1} + ⋯ + a_{0} ∈ A[X]

have |a_{n}| = 1 (i.e., a_{n} is a unit). Let g_{0}(X) and h_{0}(X) be polynomials in A[X] with degrees r and s respectively, and suppose that

∥f(X) − g_{0}(X)h_{0}(X)∥ < | Res(g_{0}(X), h_{0}(X))|^{2}

where Res denotes the resultant. Then f(X) factors in A[X] as the product of a polynomial of degree r and a polynomial of degree s. The proof follows the same general lines as the above proofs. In fact, the hypothesis can be replaced by

∥f(X) − g_{0}(X)h_{0}(X)∥ < |disc(f)|.

(For this, see J. Cassels, Local Fields, p107.)

Note that, this gives an algorithm for factoring polynomials in ℚ_{p}[X] (for example). Given f(X), compute disc(f). If this is zero, then f and f′ have a common factor (which we can find by the Euclidean algorithm). Otherise ord(disc(f)) = m for some m, and it is enough to consider factorizations of f into polynomials with coefficients in the finite ring ℤ/p^{m}. Apparently the fastest algorithms for factoring polynomials in ℤ[X] begin by factoring in ℤ_{p}[X] for an appropriate prime p— computers seem to have no problem handling polynomials of degree 200. (But Exercise 10, #3 shows that there are polynomials in ℤ[X] of arbitrarily large degree that factor in all the rings ℤ_{p}[X] into polynomials of low degree.)

Extensions of nonarchimedean valuations. We explain how to extend a valuation to a larger field. [[We need the next theorem and remark also for archimedean valuations; see 8.1.]]

Theorem 7.29. Let K be complete with respect to a discrete valuation | |_{K}, and let L be a finite separable extension of K of degree n. Then | | extends uniquely to a discrete valuation | |_{L} on L, and L is complete for the extended valuation. For all β ∈ L,

|β|_{L} = | Nm_{L/K} β|_{K}^{1/n}.

Proof. Let A be the discrete valuation ring in K, and let B be its integral closure in L. Let 𝔭 be the maximal ideal of A. We know from (3.30) that B is a Dedekind domain, and the valuations of L extending | |_{𝔭} correspond to the ideals of B lying over 𝔭.

Suppose that there are distinct prime ideals 𝔓_{1} and 𝔓_{2} in B dividing 𝔭. There will be a β ∈ B such that 𝔓_{1} ∩ A[β] ≠ 𝔓_{2} ∩ A[β]; for example, choose β ∈ B such that β ∈ 𝔓_{1}, β ∉ 𝔓_{2}. Let f(X) be the minimum polynomial of β over K, so that A[β] ≈ A[X]/(f(X)). Because f(X) is irreducible in A[X] and A is complete, Hensel’s lemma shows that f̄(X) (image of f(X) in k[X], k = A/𝔭) must be a power of an irreducible polynomial. Then

A[β]/𝔭A[β] ≈ k[X]/(f̄(X))

is a local ring, which contradicts the fact that A[β] has two prime ideals containing 𝔭.

Hence | |_{𝔭} extends uniquely to a valuation | | on L.

Clearly, | |_{𝔭} also extends uniquely to the Galois closure L′ of L. For each σ ∈ Gal(L/K), consider the map L ↪ ℂ, β ↦ |σβ|. This is again a valuation of L, and so the uniqueness implies that |β| = |σβ|. Now

| Nm(β)| = | ∏ σβ| = |β|^{n}

which implies the formula.

Finally, we have to show that L is complete. Let e_{1}, …, e_{n} be a basis for B as an A-module, and let (α(m)) be a Cauchy sequence in L. Write α(m) = a_{1}(m)e_{1} + ⋯ + a_{n}(m)e_{n}, with a_{i}(m) ∈ K. For each i, a_{i}(m) is a Cauchy sequence, and if a_{i} denotes its limit, then α =_{df} a_{1}e_{1} + ⋯ + a_{n}e_{n} is the limit of the sequence α_{m}(m). □

Remark 7.30. It is obvious from the criterion (7.2) that a nonarchimedean valuation can only extend to a nonarchimedean valuation. It is possible to prove (7.29) without assuming that the valuation | | on K is discrete or even nonarchimedean (but the proof is then completely different, and much longer). The formula |β|_{L} = | Nm_{L/K} β|_{K}^{1/n} shows that | |_{L} is discrete if and only if | |_{K} is discrete.

Corollary 7.31. Let K be as in the theorem, and let Ω be a (possibly infinite) algebraic extension of ℚ. Then | | extends in a unique way to a valuation | | on Ω.

Proof. The theorem shows that | | extends in a unique way to any finite subextension of Ω, and hence it extends uniquely to Ω. □

Remark 7.32. In the last corollary, the extended valuation in still nonarchimedean, but it need not be discrete, and Ω need not be complete. However, the completion of Ω is again algebraically closed.

For example as we noted in (7.7), the valuation on the algebraic closure ℚ_{p}^{al} of ℚ_{p} is not discrete, and Problems 10, #4, shows that ℚ_{p}^{al} is not complete. The completion of ℚ_{p}^{al} is often denoted ℂ_{p} because it plays the same role for the p-adic valuation on ℚ that ℂ plays for the real valuation. (In fact ℂ_{p} ≈ ℂ as abstract fields because they are both algebraically closed, and they both have a transcendance basis with cardinality equal to that of ℝ. The isomorphism is as far from being canonical as it is possible to get—its construction requires the axiom of choice.)

Corollary 7.33. Let K and L be as in the theorem; then n = ef where n = [L : K], e is the ramification index, and f is the degree of the residue field extension.

Proof. We know from (3.36) that n = ∑ e_{i}f_{i}. In this case, there is only one prime dividing 𝔭 and so the formula becomes n = ef. □

When e = n, so that 𝔭B = 𝔓^{n}, we say that L is totally ramified over K; when f = n, we say that L is unramified over K.

Note that the valuation ring B of L is the integral closure of the valuation ring A of K.

[[Discuss Henselian fields.]]

A brief introduction to PARI.

To start PARI, type gp To quit PARI, type \q

base(f) finds an integral basis for the field generated by a root of f (monic irreducible polynomial).

disc(f) finds the discriminant of f.

discf(f) finds the discriminant of the ring of integers (f monic irreducible).

cyclo(n) finds the n^{th} cyclotomic polynomial.

galois(f) finds the Galois group of f (f irreducible of degree ≤ 7).

galoisconj(f) finds the conjugates of a root r of the polynomial f expressed as polynomials in r.

newtonpoly(f,p) finds the Newton polygon of f.

factpol(f,d) finds the factors of f of degree ≤ d (f a polynomial with coefficients in ℤ.

Remark 7.34. Let K be complete with respect to a discrete valuation, and let L be a finite extension of K. Let 𝔭 and 𝔓 be the maximal ideals in the rings of integers A and B of K and L. Then 𝔭B = 𝔓^{e} where e is the ramification index. Let π and Π be generators of 𝔭 and 𝔓. The normalized valuations ord_{K} and ord_{L} on K and L are characterized by equations:

ord_{K}(π) = 1, ord_{L}(Π) = 1.

Note that π = Π^{e} × unit, and so

ord_{K} = e^{−1} ord_{L} .

If we denote the extension of ord_{K} to L by ord, then

ord(L^{×}) = e^{−1}ℤ.

This characterizes the ramification index.

Newton’s polygon. Let K be complete with respect to a discrete valuation. Let ord be the corresponding additive valuation ord: K^{×} → ℤ, and extend ord to a valuation ord: K^{al×} → ℚ. For a polynomial

f(X) = X^{n} + a_{1}X^{n−1} + ⋯ + a_{n}, a_{i} ∈ K,

define the Newton polygon^{8} of f(X) to be the lower convex hull of the points (i, ord(a_{i})), i = 0, ..., n.

Proposition 7.35. Suppose that the Newton polygon of f(X) ∈ K[X] has segments of x-length n_{i} and slope s_{i}. Then f(X) has exactly n_{i} roots α (in K^{al}) with

ord(α) = s_{i}.

Moreover, the polynomial f_{i}(X) =_{df} Π_{ord(α_{i})=s_{i}}(X − α_{i}) has coefficients in K.

Proof. In proving the first part, we don’t have to assume that f(X) has coefficients in K—any finite extension of K will do. Thus it suffices to prove the following statement: let f(X) = ∏(X − α_{j}); if exactly n_{i} of the α_{j}s have ord s_{i}, then the Newton polygon of f(X) has a segment of slope s_{i} and x-length n_{i}.

We prove this by induction on n = deg(f). If n = 1, then it is obvious. Assume it for n, and put

g(X) = (X − α)f(X) = X^{n+1} + b_{1}X^{n} + b_{2}X^{n−1} + ⋯ + b_{n+1}.

Note that b_{i} = a_{i} − αa_{i−1}.

Case (i). ord(α) < s_{1}. We then have^{9}

b_{1} = a_{1} − α, ord(b_{1}) = ord(α), because ord(a_{1}) ≥ s_{1} > ord α; b_{2} = a_{2} − αa_{1}, ord(b_{2}) ≥ ord(α) + s_{1},

. . . . . . . . . . . . . . .

b_{i} = a_{i} − αa_{i−1}, ord(b_{i}) = ord(α) + ord(a_{i−1}).[[??]] Thus, in this case, the Newton polygon of g is obtained from that of f by adding a segment of slope ord(α) and x-length 1, and moving the Newton polygon of f to start at (1, ord(α)). This is what the proposition predicts.

Case (ii). ord(α) = s_{1}. In this case,

b_{1} = a_{1} − α, ord(b_{1}) ≥ s_{1};

b_{2} = a_{2} − αa_{1}, ord(b_{2}) ≥ 2s_{1};

. . . . . . . . . . . . . . .

b_{n_{1}} = a_{n_{1}} − αa_{n_{1}−1}, ord(b_{i}) ≥ n_{1}s_{1}; b_{n_{1}+1} = a_{n_{1}+1} − αa_{n_{1}}, ord(b_{n_{1}+1}) = ord(αa_{n_{1}}) = (n_{1} + 1)s_{1};

8Most people write the polynomial a_{0} + a_{1}X + ⋯ + X^{n} when they define Newton polygons.

This is slightly less convenient than the way I do it, but allows you to define the Newton polygon of a power series.

9Recall ord(a + b) ≥ min{ord(a), ord(b)}, with equality if ord(a) ≠ ord(b).

. . . . . . . . . . . . . . .

In this case, the segment of slope s_{1} is lengthened by 1, and the rest of the polygon is as before. This is what the proposition predicts.

The remaining cases are similar.

We now prove the second statement. Let α be a root of f(X), and let m_{α}(X) be the minimum polynomial of α. As we saw in the proof of (7.29), ord(α′) = ord(α) for all conjugates α′ of α, i.e., for all roots of m_{α}(X). Because f(α) = 0, m_{α}(X)|f(X), and the remark just made implies that in fact m_{α}(X)|f_{i}(X) where s_{i} = ord(α). If β is a root of f_{i}(X)/m_{α}(X), then a similar argument shows that m_{β}(X)|(f_{i}/m_{α}). Continuing in this way, we find that f_{i}(X) is a product of polynomials with coefficients in K. □

Example 7.36. Consider the polynomial

f(X) =_{df} X^{3} + X^{2} + 2X − 8.

By testing ±1, ±2, ±4, ±8 (actually, by asking Maple) one sees that this polynomial is irreducible over ℚ. The Newton polygon of f relative to ord_{2} has slopes 0, 1, 2, each with x-length 1. Therefore f splits in ℚ_{2}[X], and it has roots α_{1}, α_{2}, α_{3} with ords 0, 1, 2.

Locally compact fields. We now look at the compactness properties of our fields.

Proposition 7.37. Let K be complete with respect to a nonarchimedean discrete valuation. Let A be the ring of integers in K and let 𝔪 be the maximal ideal in A. Then A is compact if and only if A/𝔪 is finite.

Proof. Let S be a set of representatives for A/𝔪. We have to show that A is compact if and only if S is finite.

⟹ : Clearly 𝔪 = {x ∈ K | |x| < 1} is open in K. As A is the disjoint union of the open sets s + 𝔪, s ∈ S, S must be finite if A is compact.

⟸ : Recall that a metric space X is compact if and only if it is complete and totally bounded (this means that for any r > 0, there is a finite covering of X by open balls of radius r). But every element of A can be written

s_{0} + s_{1}π + s_{2}π^{2} + ⋯ + s_{n}π^{n} + ⋯, s_{i} ∈ S.

For a fixed n, there are only finitely many sums

s_{0} + s_{1}π + s_{2}π^{2} + ⋯ + s_{n}π^{n}, s_{i} ∈ S,

and every element of A is within |π^{n+1}| of such an element.

Corollary 7.38. Assume that the residue field is finite. Then 𝔭^{n}, 1 + 𝔭^{n}, and A^{×} are all compact.

Proof. They are all closed subsets of A. □

Definition 7.39. A local field is a field K with a nontrivial valuation | | (in the sense of p100) such that K is locally compact (and hence complete).

Remark 7.40. It is possible to give a complete classification of local fields.

(a) Let K be a field that is complete with respect to an archimedean valuation | |; then K is isomorphic to ℝ of ℂ, and the valuation is equivalent to the usual absolute value (Theorem of Ostrowski, see Janusz II.4). Thus for archimedean valuations, completeness implies local compactness.

(b) A nonarchimedean local field K of characteristic zero is isomorphic to a finite extension of ℚ_{p}, and the valuation is equivalent to the (unique) extension of the p-adic valuation. (To prove this, note that, by assumption, K contains ℚ, and we know from (7.10) that | | induces a valuation on ℚ equivalent to the p-adic valuation for some prime number p; the closure of ℚ in K is therefore ℚ_{p}. If K has infinite degree over ℚ_{p}, it will not be locally compact.)

(c) A nonarchimedean local field K of characteristic p ≠ 0 is isomorphic to the field of formal Laurent series k((T)) over a finite field k. The field k((T)) is the completion of k(T) for the valuation defined by the ideal (T) ⊂ k[T]; it consists of finite-tailed formal power series:

∑_{i≥−n}^{∞} a_{i}T^{i}.

Unramified extensions of a local field. Again K is a field complete with respect to a discrete valuation | |. To avoid problems with separability, we assume that K and the residue field k are both perfect^{10}—of course in the case we are particularly interested in, K has characteristic zero and k is finite. Let A be the discrete valuation ring in K corresponding to | |.

If L is an algebraic (possibly infinite) extension of K, we can still define

B = {α ∈ L | |α| ≤ 1}
𝔓 = {α ∈ B | |α| < 1}

and call B/𝔓 the residue field of L.

10When k is not perfect, we should define L/K to be unramified if (a) the ramification index is 1, and (b) the residue field extension is separable. These conditions imply that L/K is separable.

With this definition, (7.41) continues to hold without K and k being assumed to be perfect

Proposition 7.41. Let L be an algebraic extension of K, and let l be the residue field of L. The map K′ ↦ k′ sending an unramified extension K′ of K contained in L to its residue field k′ is a one-to-one correspondence between the sets

{K′ ⊂ L, finite and unramified over K} ↔ {k′ ⊂ l, finite over k}.

Moreover:

(a) if K′ ↔ k′ and K′′ ↔ k′′, then K′ ⊂ K′′ ⟺ k′ ⊂ k′′;

(b) if K′ ↔ k′, then K′ is Galois over K if and only if k′ is Galois over k, in which case there is a canonical isomorphism

Gal(K′/K) → Gal(k′/k).

Proof. Let k′ be a finite extension of k. We can write it k′ = k[a]. Let f_{0}(X) be the minimum polynomial of a over k, and let f(X) be any lifting of f_{0}(X) to A[X]. As a is a simple root of f_{0}(X), Newton’s lemma (7.22) shows that there is a (unique) α ∈ L such that f(α) = 0 and α ≡ a mod 𝔓. Now K′ =_{df} K[α] has residue field k′. Thus K′ ↦ k′ is surjective. Suppose that K′ and K′′ are unramified extensions of K in L with the same residue field k′. Then K′ · K′′ is an unramified extension of K (see 6.5 and 6.6b) with residue field k′. Hence

[K′ · K′′: K] = [k′: k] = [K′: K],

and so K′′ = K′.

Statement (a) is obvious.

Assume K′ is Galois over K; then Gal(K′/K) preserves A′ (the valuation ring in K′) and its maximal ideal, and so we get a map Gal(K′/K) → Aut(k′/k). Write k′ = k[a], and let g(X) ∈ A[X] be such that ḡ(X) ∈ k[X] is the minimum polynomial of a. Let α ∈ A′ be the unique root of g(X) such that ᾱ = a. Because K′ is Galois over K, g(X) splits in A′[X], and this implies that ḡ(X) splits in k′[X], and so k′ is Galois over k. Let f = [k′: k] = [K′: K], and let α_{1}, …, α_{f} be the roots of g(X). Then

{α_{1}, ..., α_{f}} = {σα | σ ∈ Gal(L/K)}.

Because ḡ(X) is separable, the α_{i} are distinct modulo 𝔭, and this shows that the image of the map Gal(K′/K) → Gal(k′/k) has order f, and hence is an isomorphism. Conversely, suppose k′/k is Galois. Again write k′ = k[a], and α ∈ A′ lift a. It follows from Hensel’s lemma that A′ contains the conjugates of α, and hence that K′ is Galois over K. □

Corollary 7.42. There is a field K_{0} ⊂ L containing all unramified extensions of K in L (called the largest unramified extension of K in L). In fact, it is obtained from K by adjoining all roots of 1 of order prime to the characteristic of k.

Proof. Take K_{0} to be the extension corresponding to l in the theorem. □

Corollary 7.43. The residue field of K^{al} is k^{al}; there is a subfield K^{un} of K^{al} such that a subfield L of K^{al}, finite over K, is unramified if and only if L ⊂ K^{un}. (Recall that we are assuming k and K to be perfect.)

Proof. Let f_{0}(X) be any polynomial in k[X], and let f(X) be any lift of f_{0}(X) to A[X]. Then K^{al} contains all the roots of f(X), and so the residue field k′ of K^{al} contains all the roots of f_{0}(X). Hence k′ is algebraic over k, and every polynomial in k[X] splits in k′, and so it must be the algebraic closure of k. □

Remark 7.44. For those familiar with the jargon of category theory, we can be a little more precise: there is an equivalence between the category of finite unramified extensions of K and the category of finite (separable) extensions of k.

Example 7.45. Let K be a local field of characteristic zero (hence a finite extension of ℚ_{p} for some p), and let q be the order of the residue field k of K.

Recall from Math 594 that, for each n, there is an extension k_{n} of k of degree n, and that k_{n} is unique up to k-isomorphism; it is the splitting field of X^{q^{n}} − X; the Galois group Gal(k_{n}/k) is a cyclic group of order n, having as canonical generator the Frobenius element x ↦ x^{q}.

Therefore, for each n, there is an unramified extension K_{n} of k of degree n, and it is unique up to K-isomorphism; it is the splitting field of X^{q^{n}} − X; the Galois group Gal(K_{n}/K) is a cyclic group of order n, having as canonical generator the Frobenius element σ which is determined by the property:

σβ ≡ β^{q} (mod 𝔓),

all β ∈ B. (Here B is the discrete valuation ring in K_{n}, and 𝔓 is the nonzero prime ideal in B.)

Totally ramified extensions of K. Let K be a complete discretely-valued nonarchimedean field. A polynomial f(X) ∈ K[X] is said to be Eisenstein if it is Eisenstein (see p62) for the maximal ideal of the ring of integers in K, i.e., if

f(X) = a_{0}X^{n} + a_{1}X^{n−1} + ⋯ + a_{n}, with |a_{0}| = 1, |a_{i}| < 1, |a_{n}| = |π|.

Equivalently,

ord(a_{0}) = 0, ord(a_{i}) > 0, ord(a_{n}) = 1,

for the normalized additive valuation. Equivalently, the Newton polygon of f(X) has only one segment, which has slope \frac{1}{n}, n = deg f. Eisenstein polynomials allow us to give an explicit description of all totally ramified extensions of K.

Proposition 7.46. Let L be a finite extension of K. Then L/K is totally ramified if and only if L = K[α] with α a root of an Eisenstein polynomial.

Proof. ⟸ : Suppose L = K[α] with α a root of an Eisenstein polynomial f(X) of degree n. If ord is the extension of the normalized discrete (additive) valuation on K to L, then ord(α) = 1/n. This implies that the ramification index of L/K is ≥ n. But it can’t be greater than n, and so it is exactly n—L is totally ramified over K. (Compare the proof of 6.2.)

⟹ : Suppose L is a totally ramified extension of K of degree n. Let α be a generator of the maximal ideal in the ring of integers in L; thus ord(α) = 1/n if ord extends the normalized discrete valuation on K. The elements 1, α, ..., α^{n−1} represent different cosets of ord(K^{×}) in ord(L^{×}), and so it is impossible to have a nontrivial relation

a_{0} + a_{1}α + ⋯ + a_{n−1}α^{n−1} = 0, a_{i} ∈ K

(because of 7.9.3). Hence L = K[α]. The elements 1, α, …, α^{n−1}, α^{n} are linearly dependent over K, and so we have a relation:

α^{n} + a_{1}α^{n−1} + ⋯ + a_{n} = 0, a_{i} ∈ K.

Applying (7.9.3) again, we see that the minimum ord of a summand must be attained for two terms. The only way this can happen is if ord(a_{i}) > 0 for all i and ord(a_{n}) = ord(α^{n}) = 1, i.e., if ∑ a_{i}X^{i} is an Eisenstein polynomial. □

Remark 7.47. Let L be a finite totally ramified extension of K. Let A and B be the discrete valuation rings in K and L, and let π and Π be a prime elements in A and B. I claim that B = A[Π]. The proof is the same as that on p93 (and in Problems 8, #1). Because B and A have the same residue field, we know that

A[Π] + ΠB = B.

The discriminant of 1, Π, ..., Π^{n}, n = [L: K], is a (unit) × π^{m} for some m, and so

𝔭^{c}B ⊂ A[Π] ⊂ B

for some c. As before, these two conditions suffice to imply that B = A[Π].

Ramification groups. Let L be a finite Galois extension of K, and assume that the residue field k of K is perfect. As we have noted, G =_{df} Gal(L/K) preserves the valuation on L. In particular, it preserves

B = {α ∈ L | |α| ≤ 1}, 𝔓 = {α ∈ L | |α| < 1}.

Let Π be a prime element of L (so that 𝔓 = (Π)). We define a sequence of subgroups G ⊃ G_{0} ⊃ G_{1} ⊃ … by the condition:

σ ∈ G_{i} ⟺ |σα − α| < |Π|^{i}, all α ∈ B.

The group G_{0} is called the inertia group, the group G_{1} is called the ramification group, and the groups G_{i}, i > 1, are called the higher ramification groups of L over K.

Lemma 7.48. The G_{i} are normal subgroups of G, and G_{i} = {1} for i large enough.

Proof. (a) For σ, τ ∈ G, we have

|τ^{−1}στα − α| = |σ(τα) − (τα)|

(because |x| = |τx|). As α runs through B, so also does τα, and so τ^{−1}ατ ∈ G_{i} exactly when α does.

(b) If σ ≠ 1, then σα ≠ α for some α ∈ B. Hence σ ∉ G_{i} as soon as |σα − α| ≥ |Π|^{i}. □

Theorem 7.49. Let L/K be a Galois extension, and assume that the residue field extension l/k is separable.

(a) The fixed field of G_{0} is the largest unramified extension K_{0} of K in L, and

G/G_{0} = Gal(K_{0}/K) = Gal(l/k).

(b) For i ≥ 1, the group

G_{i} = {σ ∈ G_{0} | |σΠ − Π| < |Π|^{i}}.

Proof. (a) Let K_{0} be the largest unramified extension in L (see 7.42). Then σK_{0} is also unramified, and so it is contained in K_{0}. Thus K_{0} is Galois over K, and the canonical map Gal(K_{0}/K) → Gal(l/k) is an isomorphism (see 7.40b). By definition G_{0} is the kernel of G → Gal(l/k), and so K_{0} is its fixed field.

(b) Let A_{0} be the discrete valuation ring in K_{0}. Then B = A_{0}[Π] (by 7.45). Since G_{0} leaves A_{0} fixed, in order to check that σ ∈ G_{i} it suffices to check that |σα − α| < |Π|^{i} for the element α = Π. □

Corollary 7.50. We have an exhaustive filtration G ⊃ G_{0} ⊃ ⋯ such that G/G_{0} = Gal(l/k); G_{0}/G_{1} ↪ l^{×}; G_{i}/G_{i+1} ↪ l.

Therefore, if k is finite, then Gal(L/K) is solvable.

Proof. Let σ ∈ G_{0}; then σΠ is also a prime element and so σΠ = uΠ with u a unit in B. The map σ ↦ u mod 𝔓 is a homomorphism G_{0} → l^{×} with kernel G_{1}.

Let σ ∈ G_{i}. Then |σΠ − Π| ≤ |Π|^{i+1}, and so σΠ = Π + aΠ^{i+1} some a ∈ B. The map σ ↦ a (mod 𝔓) is a homomorphism G_{i} → k with kernel G_{i+1}. □

An extension L/K is said to be wildly ramified if p|e where p = char(k). Otherwise it is said to be tamely ramified. Hence for a Galois extension

L/K is unramified ⟺ G_{0} = {1},

and

L/K is tamely ramified ⟺ G_{1} = {1}.

Krasner’s lemma and applications*. Again let K be complete with respect to a discrete nonarchimedean valuation | |, and extend the valuation (uniquely) to a valuation on K^{al}. It is clear from our discussion of unramified extensions of K that roots of distinct polynomials f(X) and g(X) will often generate the same extension of K; in fact, this will be true if f̄ = ḡ and both are irreducible in k[X]. Krasner’s lemma and its consequences show that the roots of two polynomials will generate the same extension if they are sufficiently close.

Proposition 7.51. (Krasner’s lemma). Let α, β ∈ K^{al}, and assume that α is separable over K[β]. If α is closer to β than to any conjugate of α (over K), then K[α] ⊂ K[β].

Proof. Let σ be an embedding of K[α, β] into K^{al} fixing K[β]. By Galois theory, it suffices to show that σα = α. But

|σα − β| = |σα − σβ| = |α − β|

because σβ = β and |σ ∗ | = | ∗ |. Hence

|σα − α| = |σα − β + β − α| ≤ |α − β|.

Since σα is a conjugate of α over K, the hypothesis now implies that σα = α. □

Now assume K has characteristic zero (to avoid complications). As before, for h(X) = ∑ c_{i}X^{i}, we define ∥h∥ = max{|c_{i}|}. Note that if h(X) varies in a family of monic polynomials for which ∥h∥ remains bounded, then the maximum value of a root of h is bounded; in fact, if

∑ c_{i}β^{i} = 0,

we must have |β^{n}| ≤ |c_{j}β^{j}| for some j < n, and so |β|^{n−j} = |c_{j}|.

Fix a monic irreducible polynomial f(X) in K[X], and let

f(X) = ∏(X − α_{i}), α_{i} ∈ K^{al}.

The α_{i} must be distinct. Let g(X) be a second monic polynomial in K[X], and suppose that ∥f − g∥ is small. For any root β of g(X), |f(β)| = |(f − g)(β)| is small (because ∥f −g∥ small implies that ∥g∥ is bounded, and hence |β| is bounded). But

|f(β)| = ∏ |β − α_{i}|.

In order for this to be small, at least one term |β − α_{i}| must be small. By taking ∥f − g∥ small enough, we can force β to be closer to one root α_{i} than α_{i} is to any other α_{j}. That is, we can achieve:

|β − α_{i}| < |α_{i} − α_{j}|, all j ≠ i.

In this case, we say that β belongs to α_{i}. Krasner’s lemma then says that K[α_{i}] ⊂ K[β], and because f and g have the same degree, they must be equal. We have proved:

Proposition 7.52. Let f(X) be a monic irreducible polynomial of K[X], and let α be a root of f. Then any monic polynomial g(X) ∈ K[X] sufficiently close to f(X) is also irreducible, and it has a root β that belongs to α. For such a root K[α] = K[β].

Corollary 7.53. Let K be a finite extension of ℚ_{p}. Then there is a finite extension L of ℚ contained in K such that [L: ℚ] = [K: ℚ_{p}] and L · ℚ_{p} = K.

Proof. Write K = ℚ_{p}[α], and let f(X) be the minimum polynomial of α over ℚ_{p}. Choose g(X) ∈ ℚ[X] sufficiently close to f(X), and let L = ℚ[β] for β a root of g(X) belonging to α. □

Now consider two monic polynomials f and g, and write α_{i} for the roots of f and β_{i} for the roots of g. For ∥f − g∥ sufficiently small, every root of g will belong to a root of f, and I claim that they will belong to distinct roots, i.e., the roots can be numbered so that β_{i} belongs to α_{i}. For each choice s of n elements from {α_{1}, ..., α_{n}} (possibly with repetitions), we form the polynomial f_{s}(X) = ∏_{α_{i}∈s}(X −α_{i}). If two roots of g(X) belong to the same root of f(X), then g(X) will be close to f_{s}(X) for some f_{s} ≠ f. But if we choose g to be closer to f than f is to any f_{s}, this will be impossible. We have proved:

Proposition 7.54. Assume K is of characteristic zero. If two monic irreducible polynomials f and g are sufficiently close, then each root of g will belong to exactly one root of f, and so

{K[α] | α a root of f} = {K[β] | α a root of g}.

Proposition 7.55. Assume K has characteristic zero and has finite residue field. Then, up to isomorphism, there are only finitely many totally ramified extensions of ℚ_{p} of a given degree.

Proof. We fix an n and show that there are only finite many extensions of degree ≤ n. Each point of

(a_{1}, ..., a_{n}) ∈ 𝔭 × 𝔭 × 𝔭 × ⋯ × A^{×}π

defines an Eisenstein polynomial of degree n, namely,

f(X) = X^{n} + a_{1}X^{n−1} + ⋯ + a_{n},

and hence a finite set of totally ramified extensions of degree n, namely, those generated by the roots of f(X). According to the last proposition, each point of 𝔭×𝔭×𝔭×⋯×A^{×}π has a neighbourhood such that the points in the neighbourhood all give the same extensions of K. In (7.38) we showed that the factors of 𝔭 × 𝔭 × 𝔭 × ⋯ × A^{×}π are compact, hence the product is compact, and so a finite number of these neighbourhoods will cover it. □

Remark 7.56. We proved above that (i) every finite extension L of K contains a largest unramified extension of K; (ii) for each m ≥ 1, there is an unramified extension of degree m of K, and any

two such extensions are K-isomorphic.

Fix an n; then each extension L of K of degree n can be realized as a totally ramified extension of degree n/m of the (unique) unramified extension of degree m, some m dividing n. Clearly there are only finitely many such Ls (up to K-isomorphism).

§8 Global Fields

A global field is defined to be an algebraic number field (finite extension of ℚ) or a function field in one variable over a finite field (finite extension of 𝔽_{q}(T) for some q). Of course, we are mainly interested in the number field case.

Extending valuations. Let K be a field with a valuation | | (archimedean or discrete nonarchimedean), and let L be a finite separable extension of K. When K is complete, we know that there is a unique extension of | | to L (see 7.29, 7.30), and we want to understand the extensions when K is not complete.

Write L = K[α], and let f(X) be the minimum polynomial of α over K. Let | |′ be an extension of | | to L. Then we can form the completion L̂ of L with respect to | |′, and obtain a diagram:

\begin{matrix}L & ↪ & L̂ \\ | & & | \\ K & ↪ & K̂. \end{matrix}

Then L̂ = K̂[α] (because every element ξ of L̂ is the limit of a Cauchy sequence ξ(n) in L; write ξ(n) = ∑ a_{i}(n)α^{n}, a_{i}(n) ∈ K; then each a_{i}(n) is a Cauchy sequence in K, with limit a_{i} say in K̂, and ξ = ∑ a_{i}α^{i}). Let g(X) be the minimum polynomial of α over K̂. Since f(α) = 0, g(X)|f(X), and so with each extension of | |, we have associated an irreducible factor of f(X) in K̂[X].

Conversely, let g(X) be a monic irreducible factor of f(X) in K̂[X], and let K̂[x] = K̂[X]/(g(X)). Then we obtain a diagram:

L ⟶^{α↦x} K̂[x]
|  |
K ⟶  K̂.

According to (7.29, 7.30), the valuation on K̂ extends uniquely to K̂[x], and this induces a valuation on L extending | |.

These two operations are inverse, and so we have proved the following result:

Proposition 8.1. Let L = K[α] be a finite separable extension of K, and let f(X) be the minimum polynomial of α over K. Then there is a natural one-to-one correspondence between the extensions of | | to L and the irreducible factors of f(X) in K̂[X].

There is a more canonical way of obtaining the completions of L for the various extensions of | |.

Proposition 8.2. Let | | be a valuation on K (archimedean or discrete nonarchimedean) and let L be a finite separable extension of K. Let K̂ be the completion of K with respect to | |. Then | | has finitely many extensions | |_{1}, …, | |_{g} to L; if L_{i} denotes the completion of L with respect to the valuation | |_{i}, then

L ⊗_{K} K̂ ≈ ∏ L_{i}.

Proof. Since L is separable over K, L = K[α] ≈ K[X]/(f(X)) for some element α ∈ L and its minimum polynomial f(X). Suppose f(X) factors in K̂[X] as

f(X) = f_{1}(X) · f_{2}(X) ⋯ f_{g}(X)

with f_{i}(X) monic and irreducible. Then (see 1.13)

L ⊗_{K} K̂ = K[α] ⊗_{K} K̂ ≈ K̂[X]/((f(X)) ≈ ∏ K̂[X]/(f_{i}(X))

and so the proposition follows from (8.1). □

Remark. Suppose now that K is a number field, that O_{L} = O_{K}[α], and that | | = | |_{𝔭} for some prime ideal 𝔭 in O_{K}. Because f_{i}(X) is irreducible in K̂[X], Hensel’s lemma shows that, modulo 𝔭̂, f_{i}(X) is a power of an irreducible polynomial, say,

f̄_{i}(X) = g_{i}(X)^{e_{i}}.

Then

f̄(X) = ∏_{i=1}^{g} g_{i}(X)^{e_{i}},

and (3.43) tells us that

𝔭O_{L} = ∏ 𝔓_{i}^{e_{i}} , 𝔓_{i} = (𝔭, g_{i}(α)).

The valuations extending | |_{𝔭} correspond to the primes 𝔓_{i} [[not really proved anywhere(?)]], and so the two descriptions of the extensions agree.

Corollary 8.3. In the situation of the Propostion, for any element α ∈ L,

Nm_{L/K}(α) = ∏ Nm_{L_{i}/K̂}(α), Tr_{L/K}(α) = ∑ Tr_{L_{i}/K̂}(α).

(in the i^{th} factor or summand on the right, α is regarded as an element of L_{i}).

Proof. By definition the norm and trace of α are the determinant and trace of the K-linear map x ↦ αx: L → L. These don’t change when L is tensored with K̂, and it easy to see that norms and traces in products break up into products and sums respectively. □

Nonexample 8.4. According to Maple

f(X) = X^{6} + 5X^{5} + 5X^{3} + 25X + 125

is irreducible in ℚ[X]. Its Newton polygon for ord_{5} has three segments of x-lengths 3, 2, 1 respectively, and so it has at least three factors in ℚ_{5}. Unfortunately none of the computer programs can find them [[?]]. Pari claims to be able to factor in ℚ_{p}[X] (use factorpadic(f,p,r) where r is the precision required), but in fact doesn’t find all the factors. The discriminant of f(X) is

2^{4}5^{11}(59)(365587),

and so according to (7.28), to find the number of factors of f(X) in ℚ_{5}[X], it suffices to factor in modulo 5^{11}. Unfortunately, neither Maple nor Mathematica knows how factor modulo anything but a prime[[?]].

Suppose we could find a factorization

f(X) = f_{1}(X)f_{2}(X)f_{3}(X)

(to whatever degree of accuracy we wish). To compute |β|_{i}, map β = ∑ c_{j}α^{j} to β_{i} = ∑ c_{j}α_{i}^{j} ∈ L_{i} =_{df} ℚ_{5}[α_{i}], α_{i} a root of f_{i}(X), and use that

|β|_{i} = |β_{i}|_{i} = | Nm_{L_{i}/L} β|_{i}^{1/ deg f_{i}}.

The product formula. Before proving the product formula for a number field, we need one extra fact for local fields.

Let K be a local field with normalized valuation | |; recall p106 that this means that | | is the usual absolute value if K is ℝ, the square of the usual valuation if K is ℂ, and |a| = (1/ℕ𝔭)^{ord(a)} if the valuation is defined by a prime ideal 𝔭.

Let L be a finite separable extension of K, and let | | be the unique extension of | | to L. Let ∥ ∥ be the normalized valuation on L corresponding | |. What is the relation of ∥ ∥ to | |?

Lemma 8.5. In the above situation, ∥a∥ = |a|^{n}, where n = [L: K].

Proof. When K is archimedean, there are only two cases to consider, and both are obvious. Thus, assume K is nonarchimedean. Since, by assumption, ∥ ∥ = | |^{c} for some c, we only have to check that the formula holds for a prime element π of K. Let Π be a prime element of L, and let 𝔓 = (Π) and 𝔭 = (π); then π = (unit) × Π^{e}, and so

∥π∥ = ∥Π^{e}∥ = (1/ℕ𝔓)^{e} = (1/ℕ𝔭)^{ef} = |π|^{n},

as required.

Alternatively, use (7.34)^{11}. For a ∈ K, we have

∥a∥ =_{df} ℕ𝔓^{− ord_{L} a} =_{7.34} (ℕ𝔭^{f})^{−e ord_{K} a} = |a|^{ef} = |a|^{n}. □

Proposition 8.6. Let L/K be a finite extension of number fields. For any prime v of K and α ∈ L,

∏_{w|v} ∥α∥_{w} = ∥ Nm_{L/K} α∥_{v}.

Here ∥ ∥_{w} and ∥ ∥_{v} denote the normalized valuations for the primes w and v.

Proof. Let | |_{i}, i = 1, 2, …, g, be the extensions of ∥ ∥_{v} to L, and let ∥ ∥_{i} be the normalized valuation corresponding to | |_{i}. Then

∥ Nm_{L/K} α∥_{v} =_{8.3} ∥ ∏_{i=1}^{g} Nm_{L_{i}/K̂} α∥_{v} = ∏_{i=1}^{g} ∥ Nm_{L_{i}/K̂} α∥_{v}
=_{7.29} ∏_{i=1}^{g} |α|_{i}^{n(i)} =_{8.5} ∏_{i=1}^{g} ∥α∥_{w},

where n_{i} = [L_{i}: K̂]. □

11The equation on p118 should read ord_{K} = e^{−1} ord_{L}.

Theorem 8.7. (Product formula). Let K be an algebraic number field; for all nonzero α ∈ K,

∏_{w} ∥α∥_{w} = 1,

where the product is over the primes of K and ∥ ∥_{w} is the normalized valuation for the prime w.

Proof. We have

∏_{w} ∥α∥_{w} = ∏_{v}(∏_{w|v} ∥α∥_{w}) = ∏_{v} ∥ Nm α∥_{v}

where v runs through the primes 2, 3, 5, 7, ..., ∞ of ℚ. The last product is 1 by (7.11). □

Remark 8.8. E. Artin and Whaples (Bull. AMS 51, 1946, p469–492) proved the following characterization of global fields. Let K be a field with a set 𝔙 of primes (equivalence classes of valuations) satisfying the following axioms.

Axiom I. There is a set of representatives | |_{v} for the primes such that, for any nonzero a ∈ K, |a|_{v} ≠ 1 for only finitely many v and

Π_{v}|a|_{v} = 1 (product over all v ∈ 𝔙).

Axiom II. There exists at least one prime v for which K_{v} is a local field. Then K is a global field, and 𝔙 consists of all the primes for K.

Throughout his career, E. Artin promoted the idea that if only one could understand the similarities between function fields and number fields sufficiently well, then one could transfer proofs from function fields to number fields (e.g. the proof of the Riemann hypothesis!). This hasn’t worked as well as he hoped, but the analogy has still been very fruitful. In the above paper, he suggested one should develop number theory and class field theory as much as possible working only from the axioms.

Decomposition groups. Let L be a finite Galois extension of a number field K, and let G = Gal(L/K). For a valuation w of L, we write σw for the valuation such that |σα|_{σw} = |α|_{w}, i.e., |α|_{σw} = |σ^{−1}α|_{w}. For example, if w is the prime defined by a prime ideal 𝔓, then σw is the prime defined by the prime ideal σ𝔓, because

|α|_{σw} < 1 ⟺ σ^{−1}α ∈ 𝔓 ⟺ α ∈ σ𝔓.

The group G acts on the set of primes of L lying over a fixed prime v of K, and we define the decomposition (or splitting) group of w to be the stabilizer of w in G; thus

G_{w} = {σ ∈ G | σw = w}.

Equivalently, G_{w} is the set of elements of G that act continuously for the topology defined by | |_{w}. Each σ ∈ G_{w} extends uniquely to a continuous automorphism of L_{w}. Note that G_{τw} = τG_{w}τ^{−1}.

Proposition 8.9. The homomorphism G_{w} → Gal(L_{w}/K_{v}) just defined is in isomorphism.

Proof. Clearly the map is injective, and so (G_{w}: 1) ≤ [L_{w}: K_{v}]. The valuation σw has decomposition group σG_{w}σ^{−1}, which has the same order as G_{w}, and so we also have (G_{w}: 1) ≤ [L_{σw}: K_{v}]. The number of distinct ws dividing v is (G: G_{w}), and so

(G: 1) = (G: G_{w})(G_{w}: 1) ≤ ∑_{σ∈G/G_{w}}[L_{σw}: K_{v}] ≤^{(8.2)} [L: K].

Hence equality holds: (G_{w}: 1) = [L_{w}: K_{v}] (and G acts transitively on the primes dividing v, which we knew already from the proof of 3.36). [[Don’t need to assume L_{w}/K_{v} Galois, nor that G acts transitively on w|v.]] □

Let D(𝔓) (or G(𝔓)) be the decomposition group of 𝔓, so that D(𝔓) = Gal(L_{𝔓}/K_{𝔭}), and let I(𝔓) ⊂ D(𝔓) be the inertia group. We have the following picture:

𝔓  L — L_{𝔓}
e | | ⧹
𝔓_{I} L^{I(𝔓)} — L_{𝔓}^{I(𝔓)} — l
f | | | D(𝔓)/I(𝔓)
𝔓_{D} L^{D(𝔓)} — K_{𝔭} — k
g | ⧸
𝔭  K

Here:

𝔓_{I} = 𝔓 ∩ L^{I(𝔓)}, 𝔓_{D} = 𝔓 ∩ L^{D(𝔓)}, 𝔭 = 𝔓 ∩ K;

the fields in the second column are the completions of those in the first; the fields in the third column are the residue fields of those in the second.

Proposition 8.9. (a) The only prime ideal of L lying over 𝔓_{D} is 𝔓.

(b) The prime ideal 𝔓_{D} is unramified in L^{I}, and f(𝔓_{I}/𝔓_{D}) = f(𝔓/𝔭).

(c) The prime ideal 𝔓_{I} is totally ramified in L, and e(𝔓/𝔓_{I}) = e(𝔓/𝔭).

(d) If D(𝔓) is normal in G, then

𝔭O_{L^{D}} = ∏ σ𝔓_{D}

where the product is over a set of representatives for G/D(𝔓).

Proof. (a) Because L is Galois over L^{D(𝔓)}, its Galois group D(𝔓) acts transitively on the set of prime ideals of L lying over 𝔓_{D}. Thus (a) is obvious from the definition of D(𝔓).

(b), (c), (d) are similarly straightforward. □

The diagram, and the proposition, show that we can construct a chain of fields

L ⊃ L^{I} ⊃ L^{D} ⊃ K

such that all the ramification of 𝔓 over 𝔭 takes place in the top extension, all the residue field extension takes place in the middle extension, and, when L^{D} is normal over K, all the splitting takes place in the bottom extension. One should be a little careful about the last assertion when D(𝔓) is not normal in G; all we know in general is that

𝔭 · O_{L^{D}} = ∏ 𝔓_{i}^{e_{i}}, 𝔓_{1} = 𝔓_{D}

with e_{1} = 1 = f_{1} (i.e., in general 𝔭 will not split completely in L^{D}).

Remark 8.10. Let L be a Galois extension of ℚ, with Galois group G. Suppose that O_{L} = ℤ[α] for some α ∈ L. Let f(X) be the minimum polynomial of α over ℚ, and write f̄(X) for f(X) modulo p. Choose an irreducible factor g_{1}(X) of f̄(X), and let g_{1}(X)^{e_{1}} be the largest power of g_{1}(X) dividing f̄(X). According to Hensel’s lemma, g_{1}(X)^{e_{1}} lifts to an irreducible factor f_{1}(X) of f(X) in K̂[X], which can be found to any desired degree of accuracy by factoring f(X) modulo a high power of p (essentially using the method of proof of Hensel’s lemma). Let 𝔓_{1} = (p, h_{1}(α)) for any lifting h_{1} of g_{1} to ℤ[X]. Then

D(𝔓_{1}) = {σ ∈ G | σ𝔓_{1} = 𝔓_{1}},

which can be computed easily (provided G has been found explicitly as a subgroup of the symmetric group on the set of roots of f(X)). Let ᾱ be the image of α in O_{L}/𝔓_{1} = 𝔽_{p}[ᾱ]. Then g_{1}(X) is the minimum polynomial of ᾱ over 𝔽_{p}, and I(𝔓_{1}) is the subgroup of D(𝔓_{1}) fixing ᾱ. Finally D(𝔓_{1})/I(𝔓_{1}) = Gal(𝔽_{p}[ᾱ]/𝔽_{p}).

Consider a tower of fields 𝔓

\begin{aligned}1 & M & 𝔓 \\ & | \\ H & L & 𝔓_{L} \\ & | \\ G & K & 𝔭 \end{aligned}

Assume M is Galois over K with Galois group G, and that H is the subgroup of G fixing L. (Recall D(𝔓) and G(𝔓) are two notations for the same object.)

Proposition 8.11. Let 𝔓 be a prime ideal in O_{M}, and let 𝔓_{L} = 𝔓 ∩ L. (a) The decomposition group H(𝔓) of 𝔓 over L is G(𝔓) ∩ H.

(b) Suppose further that H is a normal subgroup of G, so that G/H is the Galois group of L/K. The decomposition group of 𝔓_{L} over K is the image of G(𝔓) in G/H.

Proof. (a) Clearly

H(𝔓) = {σ ∈ G | σ ∈ H, σ𝔓 = 𝔓} = H ∩ G(𝔓).

(b) This is equally obvious. □

The Frobenius element. Let L/K be a Galois extension of number fields with Galois group G. Given an ideal 𝔓 of L that is unramified in L/K we define the Frobenius element σ = (𝔓, L/K) to be the element of G(𝔓) that acts as the Frobenius automorphism on the residue field. Thus σ is uniquely determined by the following two conditions:

(a) σ ∈ G(𝔓), i.e., σ𝔓 = 𝔓;

(b) for all α ∈ O_{L}, σα ≡ α^{q} mod 𝔓, where q is the number of elements the residue field O_{K}/𝔭, 𝔭 = 𝔓 ∩ K.

We now list the basic properties of (𝔓, L/K).

(8.12.1). Let τ𝔓 be a second prime dividing 𝔭, τ ∈ G. Then G(τ𝔓) = τG(𝔓)τ^{−1}, and

(τ𝔓, L/K) = τ(𝔓, L/K)τ^{−1}.

Proof. Let α ∈ O_{L}; then

τστ^{−1}(α) = τ((τ^{−1}α)^{q} + a), some a ∈ 𝔓, and
τ((τ^{−1}α)^{q} + a) = α^{q} + τa ≡ α^{q} mod τ𝔓. □

Thus if Gal(L/K) is abelian, then (𝔓, L/K) = (𝔓′, L/K) for all primes 𝔓′ dividing 𝔭, and we write (𝔭, L/K) for this element. If Gal(L/K) is not abelian, then

{(𝔓, L/K) | 𝔓|𝔭}

is a conjugacy class in G, which (by an abuse of notation) we again denote (𝔭, L/K). Thus, for a prime 𝔭 of K, (𝔭, L/K) is either an element of Gal(L/K) or a conjugacy class depending on whether Gal(L/K) is abelian or nonabelian.

(8.12.2. Consider a tower of fields

\begin{matrix}M & 𝔔 \\ | \\ L & 𝔓 \\ | \\ K & 𝔭 \end{matrix}

and assume that 𝔔 is unramified over 𝔭; then

(𝔔, M/K)^{f(𝔓/𝔭)} = (𝔔, M/L).

Proof. Let k(𝔔) ⊃ k(𝔓) ⊃ k(𝔭) be the corresponding sequence of residue fields. Then f(𝔓/𝔭) = [k(𝔓): k(𝔭)], and the Frobenius element in Gal(k(𝔔)/k(𝔓)) is the f(𝔓/𝔭)^{th} power of the Frobenius element in Gal(k(𝔔)/k(𝔭)). □

(8.12.3). In (8.12.2), assume that L is Galois over K; then

(𝔔, M/K)|L = (𝔓, L/K).

Proof. Obvious. □

Let L_{1} and L_{2} be Galois extensions of K contained in some field Ω, and let M = L_{1} · L_{2}. Then M is Galois over K, and there is a canonical homomorphism

σ ↦ (σ|L_{1}, σ|L_{2}): Gal(M/K) → Gal(L_{1}/K) × Gal(L_{2}/K)

which is injective.

(8.12.4). Under the above map,

(𝔔, M/K) ↦ (𝔓_{1}, L_{1}/K) × (𝔓_{2}, L_{2}/K).

Proof. This follows from (8.12.3). □

Note that 𝔭 splits completely in L if and only if (𝔓, L/K) = 1 for one (hence all) primes 𝔓 lying over it. Hence, in the situation of (8.12.4), 𝔭 splits completely in M if and only if it splits completely in L_{1} and L_{2}.

Examples. We find the Frobenius maps for quadratic and cyclotomic fields, and obtain a surprisingly simple proof of the quadratic reciprocity law.

Example 8.13. Let K = ℚ[ζ_{n}], where ζ_{n} is a primitive n^{th} root of 1. If p|n then p ramifies in K, and (p, K/ℚ) is not defined. Otherwise σ = (p, K/ℚ) is the unique element of Gal(K/ℚ) such that

σα ≡ α^{p} mod 𝔭, for all α ∈ ℤ[ζ_{n}],

for any prime ideal 𝔭 lying over p.

I claim that σ is the element of the Galois group such that σ(ζ_{n}) = ζ_{n}^{p} : let 𝔭 be a prime lying over p in ℤ[ζ_{n}]; then modulo 𝔭, we have,

σ(∑ a_{i}ζ_{n}^{i}) = ∑ a_{i}ζ_{n}^{ip} ≡ ∑ a_{i}^{p}ζ_{n}^{ip} ≡ (∑ a_{i}ζ_{n}^{i})^{p}

as required.

Note that (p, K/ℚ) has order f where f is the smallest integer such that n|p^{f} −1 (because this is the order of p in (ℤ/(n))^{×}).

Example 8.14. Let K = ℚ[\sqrt{d}], and let p be a prime that is unramified in K. Identify Gal(K/ℚ) with {±1}. Then (p, K/ℚ) = +1 or -1 according as p does, or does not, split in K, i.e., according as d is, or is not, a square modulo p. Thus (p, K/ℚ) = (\frac{d}{p}).

Application: the quadratic reciprocity law. Let K = ℚ[ζ], where ζ is a primitive p^{th} root of 1, p ≠ 2. Because Gal(K/ℚ) ≈ (ℤ/pℤ)^{×} is cyclic of order p−1, it contains a unique subgroup of order (p − 1)/2 (consisting of the elements of (ℤ/pℤ)^{×} that are squares), and hence K contains a unique quadratic extension F of ℚ. If p ≡ 1 mod 4, then p is the only prime ramifying in ℚ[\sqrt{p}], and ℚ[\sqrt{p}] is the only quadratic field for which this is true. Similarly if p ≡ 3 mod 4, then −p ≡ 1 mod 4, and −p is the only prime ramifying in ℚ[\sqrt{−p}]. Thus F = ℚ[\sqrt{d}] where d = (−1)^{(p−1)/2} · p.

If q is an odd prime ≠ p; then

(q, K/ℚ)(ζ) = ζ^{q}.

Thus (q, K/ℚ) restricts to the identity element of Gal(ℚ[\sqrt{d}]/ℚ) or not according as q is a square in (ℤ/pℤ)^{×} or not. Thus (q, K/ℚ)|ℚ[√d] = (\frac{q}{p}). But we know that it is also equal to (\frac{d}{q}). Hence

(\frac{q}{p}) = (\frac{−1}{q})^{(p−1)/2} · (\frac{p}{q}) = (−1)^{(p−1)(q−1)/4} · (\frac{p}{q}).

Here we have used that -1 is square in 𝔽_{q} if and only if 4|q − 1, so that (\frac{−1}{q}) = (−1)^{(q−1)/2}. The displayed formula, together with the statements

(\frac{−1}{p}) = (−1)^{(p−1)/2}, (\frac{2}{p}) = (−1)^{(p^{2}−1)/8}

constitute the quadratic reciprocity law. (For the last formula, see Serre, Cours d’Arithmétique I.3.2; the proof of the rest of the reciprocity law there, ibid. 3.3., is essentially the above proof, made elementary.)

Computing Galois groups (the hard way). Let f(X) be a polynomial over a field K, and let α_{1}, …, α_{n} be the roots of f(X) in K^{al}. We want to determine the Galois group of f as a subgroup of the group of permutations S_{n} of {α_{1}, …, α_{n}}.

Introduce variables t_{1}, …, t_{n}. For any σ ∈ S_{n} and polynomial f(t_{1}, …, t_{n}), define σ_{t}f = f(t_{σ(1)}, …, t_{σ(n)}). Let θ = ∑ α_{i}t_{i}, and define a polynomial

F (X, t) = ∏(X − σ_{t}θ) (product over σ ∈ S_{n}).

The coefficients of this polynomial are symmetric polynomials in the α_{i}, and so lie in K. Now factor

F (X, t) = F_{1}(X, t) ⋯ F_{r}(X, t)

in K[X, t_{1}, …, t_{n}].

Theorem 8.15. Let G be the set of σ ∈ S_{n} such that σ_{t} fixes F_{1}(X, t); then G is the Galois group of f.

Proof. See van der Waerden, Vol 1, §61 (Calculation of the Galois group). □

This theorem gives an algorithm (unfortunately impractical) for computing the Galois group of a polynomial f(X) ∈ ℚ[X]. We may suppose f(X) to be monic with integer coefficients. First find the roots of f(X) to a high degree of accuracy. Then compute F (X, t) exactly, noting that this has coefficients in ℤ. Factor F (X, t), and take one of the factors F_{1}(X, t). Finally list the elements σ of S_{n} such that σ_{t} fixes F_{1}(X, t). The problem with this approach is that F (X, t) has degree n!. It will probably work (on a computer) if n ≤ 5, but otherwise it is like trying to compute a determinant directly from the definition as a sum of products.

Computing Galois groups (the easy way). We now give a more practical procedure (also largely in van der Waerden with a more direct proof).

Proposition 8.16. Let f(X) be a monic separable polynomial of degree n over a field K, and suppose that the Galois group G ⊂ S_{n} of f(X) has s orbits, with n_{1}, …, n_{s} elements respectively (so that n_{1} + n_{2} + ⋯ + n_{s} = n); then there is a factorization

f(X) = f_{1}(X) ⋯ f_{r}(X)

with f_{i}(X) an irreducible polynomial in K[X] of degree n_{i}.

Proof. Write f(X) = ∏(X − α_{i}). For S ⊂ {1, 2, …, n}, consider f_{S} = ∏_{i∈S}(X − α_{i}). This polynomial divides f(X), and it is fixed under the action of G (and hence has coefficients in K) if and only if S is stable under G. Therefore the irreducible factors of f(X) are the polynomials f_{S} with S a minimal subset of {1, …, n} stable under G, but such sets S are precisely the orbits of G in {1, 2, …, n}. □

Let σ ∈ S_{n}. In Math 594 one proves that σ is a product of disjoint cycles. More precisely, if

o_{1} = {m_{11}, …, m_{1n_{1}}}, o_{2} = {m_{21}, ⋯, m_{2n_{2}}}, ...

are the orbits of < σ > acting on {1, 2, ..., n}, numbered in such a way that σm_{ij} = m_{i j+1}, then

σ = (m_{11} … m_{1n_{1}}) · (m_{21} … m_{2n_{2}}) · . . . .

This remark, together with (8.16), gives us the following result.

Corollary 8.17. Let f(X) be a monic separable polynomial of degree n over a finite field k, and let ℓ be the splitting field of f(X). Suppose that the Frobenius element σ ∈ Gal(ℓ/k) (when regarded as a permutation of the roots of f(X)) is a product of disjoint cycles σ = c_{1} ⋯ c_{s} with c_{i} of length n_{i} (so that ∑ n_{i} = n). Then f(X) factors as a product of irreducible polynomials in k[X]

f(X) = f_{1}(X) ⋯ f_{r}(X)

with f_{i} of degree n_{i}.

In other words, the type of the cycle decomposition of σ can be read off from the factorization of f(X).

Theorem 8.18 (Dedekind). Let f(X) be a polynomial of degree n over a number field K, and let G be the Galois group of f. Assume f(X) ∈ O_{K}[X] and is monic. Let 𝔭 be a prime ideal of K, and suppose that

f(X) ≡ f_{1}(X) ⋯ f_{r}(X) mod 𝔭

with the f_{i} distinct irreducible polynomials in k[X] and f_{i} of degree n_{i}, k = O_{K}/𝔭. Then G contains a permutation σ that is a product of disjoint cycles of length n_{i}.

Proof. Take σ to be the Frobenius element of any prime lying over 𝔭—the hypothesis on the factorization of f(X) mod 𝔭 implies that 𝔭 is unramified in the splitting field (because it implies that 𝔭 doesn’t divide the discriminant of f. □

Remark 8.19. There is a similar statement for real primes, namely, if f(X) = f_{1}(X) ⋯ f_{r}(X) in ℝ[X] with f_{1}, …, f_{j} of degree 2 and the remainder of the degree 1, then G contains a permutation σ that is a product of disjoint j cycles of length 2.

This suggests the following strategy for factoring a polynomial ℚ[X]: factor f(X) modulo many primes p; discard the result if f(X) mod p has multiple factors; continue until a sequence of, say n, primes has yielded no new cycle types for the elements. Then attempt to read off the type of the group from tables. We discuss how effective this is later.

Example 8.20. Let f(X) = X^{5} −X −1. Modulo 2 this factors as (X^{2} +X +1)(X^{3} + X^{2} + 1); modulo 3 it is irreducible. Hence G contains (12345) and (ik)(ℓmn) for some numbering of the roots. It also contains ((ik)(ℓmn))^{3} = (ik), and this implies that G = S_{5} (see 8.23 below).

Lemma 8.21. Let H be a subgroup of S_{n}; if H is transitive (for example, contains an n-cycle) and contains an (n − 1)-cycle and a transposition, then H = S_{n}.

Proof. After possibly renumbering, we may suppose that the (n − 1)-cycle is (1 2 3 … n − 1). By virtue of the transitivity, the transposition can be transformed into (in), some i ≤ n − 1. Now the (n − 1)-cycle and its powers will transform this into (1 n), (2 n), …, (n − 1 n), and these elements obviously generate S_{n} (because S_{n} is generated by transpositions). □

Example 8.22. Select monic polynomials of degree n, f_{1}, f_{2}, f_{3} with coefficients in ℤ such that

(a) f_{1} is irreducible modulo 2;

(b) f_{2} =(degree 1)(irreducible of degree n − 1) mod 3;

(c) f_{3} =(irreducible of degree 2)(product of one or two irreducible polynomials of odd degree) mod 5. We need to choose f_{3} to have distinct roots modulo 5.

Take

f = −15f_{1} + 10f_{2} + 6f_{3},

and let G be the Galois group of f. Then (a′) G is transitive (it contains an n-cycle because of (a)); (b′) G contains a cycle of length n − 1; (c′) G contains a transposition (because it contains the product of a transposition

with a commuting element of odd order).

The above lemma shows that G = S_{n}.

Remark 8.23. There are other criteria for a subgroup H of S_{n} to be all of S_{n}. For example, a subgroup H of S_{p}, p prime, that contains an element of order p and a transposition is equal to S_{p}. (See Math 594, or Jacobson, Basic Algebra I, 4.10.)

Remark 8.24. In P &Z p73, there are suggestions for constructing irreducible polynomials f(X) of degree n in 𝔽_{p}[X]. A root of such a polynomial will generate 𝔽_{q}, q = p^{n}, and so every such f(X) will divide X^{q} − X. One can therefore find all f(X)s by factoring X^{q} − X.

For example, consider X^{125} − X ∈ 𝔽_{5}[X]. Its splitting field is 𝔽_{125}, which has degree 3 over 𝔽_{5}. The factors of X^{125} − X are the minimum polynomials of the elements of 𝔽_{125}. They therefore have degree 1 or 3. There are 5 linear factors, X, X − 1, X − 2, X − 3, X − 4, and 40 cubic factors, which constitute a complete list of all the monic irreducible cubic polynomials in 𝔽_{5}[X]. (Maple factors X^{125} − X in 2 seconds and X^{625} − X in 13 seconds on my notebook computer.)

However, if you only want one irreducible polynomial of degree n, it is easier to write down a polynomial at random, and check whether it is irreducible.

Cubic polynomials. The group S_{3} has the following subgroups:

order  group  group elements
1  1  1
2  C_{2}  1 × 1 + 1 × 2
3  A_{3}  1 × 1 + 2 × 3
6  S_{3}  1 × 1 + 3 × 2 + 2 × 3.

By this I mean S_{3} has one 1-cycle, three 2-cycles, and two 3-cycles.

Note that any subgroup of S_{3} containing cycles of length 2 and 3 is the whole of S_{3}; thus if f is irreducible modulo some prime and has an irreducible factor of degree 2 modulo a second prime, then its Galois group is S_{3}. On the other hand, if factorizing f modulo many primes doesn’t turn up a factor of degree 2, but f is irreducible, then expect the Galois group of f to be A_{3}. This can be checked by seeing whether disc(f) is a square. For example, the calculations on p61 show that the polynomials X^{3} + 10X + 1 and X^{3} − 8X + 15 both have Galois group S_{3}.

To make this more effective (in the technical sense), we need the Chebotarev density theorem.

Chebotarev density theorem.

Definition 8.25. Let S be a set of finite primes in a number field K, and let P be the set of all finite primes. We say that S has natural density δ if

lim_{N→∞} \frac{#\{𝔭 ∈ S | ℕ𝔭 ≤ N\}}{#\{𝔭 | ℕ𝔭 ≤ N\}} = δ.

Theorem 8.26. (Chebotarev density theorem). Let L be a finite Galois extension of the number field K, with Galois group G, and let C be a conjugacy class in G. The set of prime ideals 𝔭 of K such that (𝔭, L/K) = C has density δ = #C/#G.

Proof. See next term (in fact, normally one proves this result with a slightly weaker notion of density). □

For example, if G is abelian, then for each σ ∈ G, the set of 𝔭 such that (𝔭, L/K) = σ has density 1/#G.

Corollary 8.27. The primes that split in L have density 1/[L : K]. In particular, there exist infinitely many primes of K not splitting in L.

Remark 8.28. There is a bound for the error in (8.26) (in terms of the discriminant of the polynomial), but it is too large to be of practical importance. However the existence of the bound has the following consequence: given a polynomial f(X) ∈ ℚ[X] (say), there exists a bound B such that, if a given cycle type doesn’t occur as the Frobenius element of some p ≤ B, then it doesn’t occur at all. [For a discussion of the effective Chebotarev density theorem, see Lagarias and Odlysko, in Algebraic Number Fields, ed. A Fröhlich, QA247 A52281.]

Example 8.29. Let K = ℚ[ζ_{n}]. Then Gal(K/ℚ) = (ℤ/nℤ)^{×} and (p, K/ℚ) = [p]. The Chebotarev density thereom says that the primes are equidistributed among the congruence classes. In other words, each of the arithmetic progression

k, k + n, k + 2n, k + 3n, … gcd(k, n) = 1,

contains 1/φ(n) of the primes. In particular, each of the arithmetic progressions contains infinitely many primes. This statement was conjectured by Legendre and proved by Dirichlet (using Dirichlet series). The proof of the Chebotarev density theorem is a generalization of that of Dirichlet.

Example 8.30. In a quadratic extension, half the primes split and half the primes remain prime.

Example 8.31. Let f be a cubic polynomial with coefficients in ℚ. The Chebotarev density theorem implies the following statements (see the table on p138):

G = 1: f splits modulo all primes.

G = C_{2}: f splits for 1/2 of the primes and has an irreducible factor of degree 2 for 1/2 of the primes.

G = A_{3}: f splits for 1/3 of the primes and f remains irreducible for 2/3 of the primes.

G = S_{3}: f splits for 1/6 of the primes, has a factor of degree 2 for 1/2 of the primes, and remains prime for 1/3 of the primes.

Example 8.32. Let f be a quartic polynomial with no linear factor.

(a) When Disc(f) is a square, the possible Galois groups are:

order  group  elements
2  C_{2}  1 × 1 + 1 × 2^{2};
4  𝔙_{4}  1 × 1 + 3 × 2^{2};
12  𝔄_{4}  1 × 1 + 3 × 2^{2} + 8 × 3.

(b) When Disc(f) is not a square, the possible Galois groups are:

4  C_{4}  1 × 1 + 1 × 2^{2} + 2 × 4;
8  D_{8}  1 × 1 + 2 × 2 + 3 × 2^{2} + 2 × 4;
24  𝔖_{4}  1 × 1 + 3 × 2^{2} + 6 × 2 + 8 × 3 + 6 × 4.

Thus if f is a polynomial of degree 4 with Galois group D_{8}, then it will split modulo p for 1/8 of the primes, factor as the product of a quadratic and two linear polynomials for 1/4 of the primes, factor as the product of two quadratics for 3/8 of the primes, and remain irreducible for 1/4 of the primes.

For a similar table for polynomials of degree 5, see P&Z p132. The strategy for determining the Galois group of a polynomial is

(a) test whether f is irreducible over ℚ;

(b) compute the discriminant of f;

(c) factor f modulo good primes (i.e., those not dividing the discriminant) until seem to be getting no new cycle types;

(d) compute the orbit lengths on the r-sets of roots (these are the degrees of the irreducible factors in ℚ[X] of the polynomial whose roots are the sums of r roots of f);

(e) ad hoc methods. As late as 1984, it had not been proved that the Mathieu group M_{11} occurs as a

Galois group over ℚ (M_{11} is subgroup of S_{11} of order 11!/5040 = 7920). References. Butler and McKay: The transitive groups of degree up to eleven, Comm. Algebra

11 (1983), 863-911. (This lists all transitive subgroups of S_{n}, n ≤ 11, and gives the cycle types of their elements and the orbit lengths of the subgroup acting on the r-sets of roots; with a few exceptions, these invariants are sufficient to determine the subgroup up to isomorphism.)

Computers: A program for finding the Galois group of a polynomial of degree ≤ 7 is implemented in Maple and in Pari.

Ford and McKay: in Computer Algebra, QA155.7 E4 C6491. Pohst and Zassenhaus. Chapter 2 is entirely concerned with computing Galois

groups; for example, II.10.8 discusses the following problem: given G ⊂ H ⊂ S_{n}, determine whether G is contained in a given smaller subgroup J of G.)

Soicher: An algorithm for computing Galois groups, in Computational Group Theory, ed M. Atkinson, 1984, 291-296.

Soicher and McKay, Computing Galois groups over the rationals, J. Number Theory, 20 (1985) 273-281.

Applications of the Chebotarev density theorem. We now discuss some other applications of the Chebotarev density theorem.

For any extension L/K of number fields, write Spl(L/K) for the set of primes that split completely in L, and write Spl′(L/K) for the set of primes that have at least one split factor. Then Spl(L/K) ⊂ Spl′(L/K) always, and equality holds if L/K is Galois, in which case the Chebotarev density theorem shows that Spl(L/K) has density 1/[L : K].

Proposition 8.33. If L and M are Galois over K, then

L ⊂ M ⟺ Spl(L/K) ⊃ Spl(M/K).

Proof. ⟹ : This is obvious.

⟸ : We have

Spl(LM/K) = Spl(L/K) ∩ Spl(M/K).

To see this, note that

𝔭 ∈ Spl(LM/K) ⟺ (𝔭, LM/K) = 1
⟺ (𝔭, LM/K)|L = 1 and (𝔭, LM/K)|M = 1;

but (𝔭, LM/K)|L = (𝔭, L/K) and (𝔭, LM/K)|M = (𝔭, M/K). Now

Spl(M/K) ⊂ Spl(L/K) ⟹ Spl(LM/K) = Spl(M/K)
⟹ _{8.26}[LM: K] = [M: K] ⟹ L ⊂ M.

□

Corollary 8.34. If L and M are Galois over K, then

L = M ⟺ Spl(M/K) = Spl(L/K).

Proof. Obvious from the Proposition. □

Remark 8.35. (a) In fact, L = M if Spl(M/K) and Spl(L/K) differ by at worst a finite set of primes (or if they differ by at worst a set of primes of density zero).

(b) The effective form of the Chebotarev density theorem shows that (8.33) is effective: in order to show that L ⊂ M it suffices to check that

𝔭 splits in M ⟹ 𝔭 splits in L for all primes 𝔭 less than some bound.

(c) Proposition 8.34 is not true without the Galois assumptions: there exist nonisomorphic extensions L and M of ℚ such that Spl(L/K) = Spl(M/K). In fact there exist nonisomorphic extensions L and M of ℚ of the same degree such that

(i) L and M have the same discriminant; (ii) a prime p not dividing the common discriminant decomposes in exactly the

same way in the two fields.

(d) It is clear from (8.34) that if a separable polynomial f(X) ∈ K[X] splits into linear factors mod 𝔭 for all but finitely many primes 𝔭 of K, then f(X) splits into linear factors in K[X]. With a little more work, one can show that an irreducible polynomial f(X) ∈ K[X] can not have a root mod 𝔭 for all but a finite number of primes. This last statement is false for reducible polynomials—consider for example,

(X^{2} − 2)(X^{2} − 3)(X^{2} − 6).

For more on these questions, see Cassels-Fröhlich, Exercise 6, p361.

Example 8.35. Fix a number field K. According to (8.34), a Galois extension L of K is determined by the set Spl(L/K). Thus, in order to classify the Galois extensions of K, it suffices to classify the sets of primes in K that can occur as Spl(L/K). For abelian extensions of K, class field theory does this—see next term (they are determined by congruence conditions). For nonabelian extensions the sets are still a mystery—they are not determined by congruence conditions—but Langlands’s conjectures shed some light.

Topics not covered*.

More algorithms. Let K be a number field. There is a rather simple algorithm for factoring a polynomial f(X) ∈ K[X] which involves only:

(a) forming resultants of polynomials over ℚ, and

(b) factoring polynomials over ℚ, both of which Maple and Mathematica can do. However, Maple knows how to factor polynomials over number fields other than ℚ.

The Hasse principle for quadratic forms. Consider a quadratic form

Q(X_{1}, …, X_{n}) = ∑ a_{ij}X_{i}X_{j}

over a field k. By a nontrivial zero of Q we mean an n-tuple (a_{1}, …, a_{n}) ≠ (0, …, 0) such that

Q(a_{1}, …, a_{n}) = 0.

Theorem 8.36 (Hasse Principle). A quadratic form Q over ℚ has a nontrivial zero in ℚ if and only if it has a nontrivial zero in ℝ and in ℚ_{p} for each p.

Proof. The necessity is obvious. The key point in the sufficiency is the quadratic reciprocity law. See Serre, Cours d’Arithmétique, Ch. IV. □

The same theorem holds for any number field K, with much the same proof, except that there is no longer an elementary proof of the quadratic reciprocity law. Instead, one obtains it as a special case of the Artin reciprocity law, which will be proved in Math 776.

Algebraic function fields. Appropriately interpreted, everything we have proved for algebraic number fields also holds for finite extensions of 𝔽_{p}(X).

Suppose K is such a field, and let k be the algebraic closure of 𝔽_{p} in K. It is a finite field, and it is possible to find an element X ∈ K such that K is a finite separable extension of k(X). Let O_{K} be the integral closure of k[X] in K. According to (3.30), it is a Dedekind domain, and one can show that it has finite class number. Moreover, K^{×} contains only finitely many roots of unity, and the rank of O_{K}^{×} is s − 1 where s is the “number of primes at infinity”. Let O′_{K} be the integral closure of k[X^{−1}] in K; then the primes at infinity are those corresponding to the prime ideals in O′_{K} lying over the prime ideal (X^{−1}) ⊂ k[X^{−1}]. See for example, P.M. Cohn, Algebraic Numbers and Algebraic Functions. Generally, the same proofs work in the two cases.

I haven’t discussed function fields in this course from lack of time and because it is possible to give a more geometric approach in the function field case. Every K as above can be realized as the field of algebraic functions on a unique nonsingular projective algebraic curve C over k, and it is more illuminating to discuss the arithmetic of K in terms of the geometry of C than to simply translate the proofs from the number field case.

[[The problem sets and the final exam have been omitted.]] THE END.