Lecture 11: Primitive Roots

William Stein

Math 124 Harvard University Fall 2001

Key Idea: There is an element of (ℤ/pℤ) of order p − 1.

1 Polynomials over ℤ/pℤ

Proposition 1.1. Let f ∈ (ℤ/pℤ)[x] be a nonzero polynomial over the ring ℤ/pℤ. Then there are at most deg(f) elements α ∈ ℤ/pℤ such that f(α) = 0.

Proof. We proceed by induction on deg(f). The cases deg(f) = 0, 1 are clear. Write f = a_{n}x^{n} + ⋯ a_{1}x + a_{0}. If f(α) = 0 then

f(x) = f(x) − f(α)
= a_{n}(x^{n} − α^{n}) + ⋯ a_{1}(x − α) + a_{0}(1 − 1)
= (x − α)(a_{n}(x^{n−1} + ⋯ + α^{n−1}) + ⋯ a_{1})
= (x − α)g(x),

for some polynomial g(x) ∈ (ℤ/pℤ)[x]. Next suppose that f(β) = 0 with β ≠ α. Then (β−α)g(β) = 0, so, since β−α ≠ 0 (hence gcd(β−α, p) = 1, we have g(β) = 0. By our inductive hypothesis, g has at most n − 1 roots, so there are at most n − 1 possibilities for β. It follows that f has at most n roots.

Proposition 1.2. Let p be a prime number and let d be a divisor of p − 1. Then f(x) = x^{d} − 1 ∈ (ℤ/pℤ)[x] has exactly d solutions.

Proof. Let e be such that de = p − 1. We have

x^{p−1} − 1 = (x^{d})^{e} − 1
= (x^{d} − 1)((x^{d})^{e−1} + (x^{d})^{e−2} + ⋯ + 1)
= (x^{d} − 1)g(x),

where deg(g(x)) = p−1−d. Recall that Fermat’s little theorem implies that x^{p−1}−1 has exactly p − 1 roots in ℤ/pℤ. By Proposition 1.1, f(x) has at most p − 1 − d roots and x^{d} − 1 has at most d roots, so g(x) has exactly p − 1 roots and x^{d} − 1 has exactly d roots, as claimed.

WARNING: The analogue of this theorem is false for some f ∈ (ℤ/nℤ)[x] with n composite. For example, if n = n_{1} · n_{2} with n_{1}, n_{2} ≠ 1, then f = nx has at least two distinct zeros, namely 0 and n_{2} ≠ 0.

2 The Structure of (ℤ/pℤ)^{∗} = {1, 2, …, p − 1}

In this section, we prove that the group (ℤ/pℤ)^{∗} is cylic.

Definition 2.1. A primitive root modulo p is an element of (ℤ/pℤ)^{∗} of order p − 1.

Question: For which primes p is there a primitive root? (Ans. Every prime.)

Lemma 2.2. Suppose a, b ∈ (ℤ/nℤ)^{∗} have orders r and s, respectively, and that gcd(r, s) = 1. Then ab has order rs.

This is a general fact about commuting elements of a group.

Proof. Since (ab)^{rs} = a^{rs}b^{rs} = 1, the order of ab is a divisor r_{1}s_{1} of rs, where r_{1} | r and s_{1} | s. Thus

a^{r_{1}s_{1}}b^{r_{1}s_{1}} = (ab)^{r_{1}s_{1}} = 1.

Raise both sides to the power r_{2}, where r_{1}r_{2} = r. Then

a^{r_{1}r_{2}s_{1}}b^{r_{1}r_{2}s_{1}} = 1,

so, since a^{r_{1}r_{2}s_{1}} = (a^{r_{1}r_{2}})^{s_{1}} = 1,

b^{r_{1}r_{2}s_{1}} = 1.

This implies that s | r_{1}r_{2}s_{1}, and, since gcd(s, r_{1}r_{2}) = 1, it follows that s = s_{1}. A similar argument shows that r = r_{1}, so the order of ab is rs.

Theorem 2.3. For every prime p there is a primitive root mod p. In other words, the group (ℤ/pℤ)^{∗} is a cyclic group of order p − 1.

Proof. Write

p − 1 = q_{1}^{n_{1}}q_{2}^{n_{2}} ⋯ q_{r}^{n_{r}}

as a product of distinct primes q_{i}.

By Proposition 1.2, the polynomial x^{q_{i}^{n_{i}}} − 1 has exactly q_{i}^{n_{i}} roots, and the polynomial x^{q_{i}^{n_{i}−1}} − 1 has exactly q_{i}^{n_{i}−1} roots. Thus there is an a_{i} ∈ ℤ/pℤ such that

a_{i}^{q_{i}^{n_{i}}} = 1 but a_{i}^{q_{i}^{n_{i}−1}} ≠ 1. This a_{i} has order q_{i}^{n_{i}}. For each i = 1, …, r, choose such an a_{i}. By repeated application of Lemma 2.2, we see that

a = a_{1}a_{2} ⋯ a_{r}

has order q_{1}^{n_{1}} ⋯ q_{r}^{n_{r}} = p − 1, so a is a primitive root.

Remark 2.4. There are φ(p − 1) primitive roots modulo p, since there are q_{i}^{n_{i}} − q_{i}^{n_{i}−1} ways to choose a_{i}. To see this, we check that two distinct choices of sequence a_{1}, …, a_{r} define two different primitive roots. Suppose that

a_{1}a_{2} ⋯ a_{r} = a′_{1}a′_{2} ⋯ a′_{r},

with a_{i}, a′_{i} of order q_{i}^{n_{i}}, for i = 1, …, r. Upon raising both sides of this equality to the power s = q_{2}^{n_{2}} ⋯ q_{r}^{n_{r}}, we see that a_{1}^{s} = a_{1}^{′s}. Since gcd(s, q_{1}^{n_{1}}) = 1, there exists t such that st ≡ 1 (mod q_{1}^{n_{1}}). It follows that

a_{1} = (a_{1}^{s})^{t} = (a_{1}^{′s})^{t} = a′_{1}.

Upon canceling a_{1} from both sides, we see that a_{2} ⋯ a_{r} = a′_{2} ⋯ a′_{r}; by repeating the above argument, we see that a_{i} = a′_{i} for all i. Thus, different choices of the a_{i} must lead to different primitive roots; in other words, if the primitive roots are the same, then the a_{i} were the same.

For example, there are φ(16) = 2^{4} − 2^{4} = 8 primitive roots mod 17:

? for(n=1,16,if(znorder(Mod(n,17))==16,print1(n," ")))
3 5 6 7 10 11 12 14

Example 2.5. In this example, we illustrate the proof of Theorem 2.3 when p = 13. We have

p − 1 = 12 = 2^{2} · 3.

The polynomial x^{4} − 1 has roots {1, 5, 8, 12} and x^{2} − 1 has roots {1, 12}, so we take a_{1} = 5. The polynomial x^{3} − 1 has roots {1, 3, 9}, so set a_{2} = 3. Finally, a = 5 · 3 = 15 = 2. Note that the successive powers of 2 are

2, 4, 8, 3, 6, 12, 11, 9, 5, 10, 7, 1,

so 2 really does have order 12.

Example 2.6. The result is false if, e.g., p is replaced by a big power of 2. The elements of (ℤ/8ℤ)^{∗} all have order dividing 2, but φ(8) = 4.

Theorem 2.7. Let p^{n} be a power of an odd prime. Then there is an element of (ℤ/p^{n}ℤ)^{∗} of order φ(p^{n}). Thus (ℤ/p^{n}ℤ)^{∗} is cyclic.

I will not prove Theorem 2.7 in class. I will probably put a problem on your next homework set that will guide you to a proof.

3 Artin’s Conjecture

Conjecture 3.1 (Emil Artin). If a ∈ ℤ is not −1 or a perfect square, then the number N(x, a) of primes p ≤ x such that a is a primitive root modulo p is asymptotic to C(a)π(x), where C(a) is a constant that depends only on a. In particular, there are infinitely many primes p such that a is a primitive root modulo p.

Nobody has proved this conjecture for even a single choice of a. There are partial results, e.g., that there are infinitely many p such that the order of a is divisible by the largest prime factor of p−1. (See, e.g., Moree, Pieter, A note on Artin’s conjecture.)