Galois theory

On the night before 30 May 1832 the twenty-year-old Évariste Galois was writing a letter to his friend Auguste Chevalier. In the morning he had a duel to fight, and by all appearances he didn’t expect to survive it. But the letter isn’t a farewell; it’s businesslike: over a few pages Galois lists what he has understood about algebraic equations, what he has proved and what he has only guessed. At the end he asks that Jacobi or Gauss be publicly asked to give their opinion “not on the truth, but on the importance of these theorems”, and hopes that later there will be people who find it profitable to decipher all this mess.

The last chapter ended with a question that this “mess” answers: why is there no formula for the quintic? This is big question 3 from the introduction. In chapter 14 we took apart the formulas for degrees three and four, found in sixteenth-century Italy. After that, for almost three hundred years, the best mathematicians looked for a formula for degree five, and every attempt failed. Galois, the one whose name the finite fields $GF(p^n)$ of the last chapter bear, explained why, and the explanation turned out to be worth more than the answer itself: group theory grew out of it.

The chapter has two strands. The first is Galois’s life, short and turbulent. The second is a proof devised a hundred and thirty years after his death by Vladimir Igorevich Arnold for Moscow schoolchildren. There’s almost no algebra in it: the roots of an equation will move about the plane, plait themselves into a braid and swap places. And at the end the same ideas will settle problems that have been fought over since antiquity: doubling the cube, trisecting an angle and constructing regular polygons.

What “no formula” means

The quadratic formula is a recipe: take the coefficients, add, subtract, multiply, divide, take a square root. Cardano’s formula is the same recipe with cube roots added. Ferrari’s formula for degree four is longer but made from the same operations. Let’s say precisely what was being sought for degree five.

Roots are taken of complex numbers: a number $w \ne 0$ has exactly $n$ $n$th roots, the vertices of a regular $n$-gon (chapter 15), and a formula is entitled to use any of them. Cardano’s formula already works like this: out of three cube roots a matching pair has to be chosen.

The first to think seriously about why the formulas for small degrees work was Joseph-Louis Lagrange. In a long memoir, Reflections on the Algebraic Solution of Equations (1770–1771), he went through all the known methods and found a common mechanism in them, which the next section is about. For degree five the same mechanism led to an auxiliary equation of degree six: the problem got harder, not easier. Lagrange suspected there was no formula but couldn’t prove it. In 1799 Paolo Ruffini published a proof of impossibility, but it had a gap. A complete proof was given in 1824 by a young Norwegian, Niels Henrik Abel.

“There’s no general formula” doesn’t mean that no quintic equation can be solved. The equation $x^5 = 2$ is solved at once: $x = \sqrt[5]{2}$. A whole family of more complicated equations can be solved too, as Abraham de Moivre worked out back in 1707.

The constant term: the only coefficient that varies; the others are fixed. The first root of the quadratic equation $t^2 - zt + 1 = 0$. The second root of the same equation. The product of the two fifth roots must equal $1$: of the five values of the second radical, the one that’s the inverse of the first term is taken. Where the formula comes from: if $x = w + \frac1w$, then multiplying out gives $x^5 - 5x^3 + 5x = w^5 + \frac{1}{w^5}$, and the equation becomes quadratic in $w^5$. Example: at $z = 3$ we have $w^5 = \frac{3 + \sqrt5}{2}$, $w \approx 1.2123$, $x = w + \frac1w \approx 2.0372$. Check: $2.0372^5 - 5 \cdot 2.0372^3 + 5 \cdot 2.0372 \approx 35.086 - 42.272 + 10.186 = 3$.

So the question to ask isn’t “can degree five be solved” but which equations can, and why the general one can’t. We’ll soon see that the equation $x^5 - 5x = z$, which looks simpler than de Moivre’s, has no formula in radicals at all.

Symmetries of the roots

Let’s look at the quadratic $x^2 + bx + c = 0$ with roots $x_1$ and $x_2$ through Lagrange’s eyes. By Vieta’s formulas $x_1 + x_2 = -b$ and $x_1x_2 = c$. These expressions don’t change if the roots are swapped, and so they’re written in terms of the coefficients without any radicals. The difference $x_1 - x_2$ changes sign under the swap. But its square is symmetric again: $(x_1 - x_2)^2 = (x_1 + x_2)^2 - 4x_1x_2 = b^2 - 4c$. Hence $x_1 - x_2 = \sqrt{b^2 - 4c}$ up to the choice of the value of the root, and then $x_{1,2} = \frac{(x_1 + x_2) \pm (x_1 - x_2)}{2}$, the familiar formula. The square root was needed exactly where the expression stopped being symmetric.

Lagrange treated the cubic in the same way. Let $\omega$ be a cube root of unity other than $1$, so that $\omega^3 = 1$ and $\omega^2 + \omega + 1 = 0$. Under a cyclic shift of the roots $x_1 \to x_2 \to x_3 \to x_1$ the expression $u = x_1 + \omega x_2 + \omega^2 x_3$ is multiplied by a power of $\omega$, and its cube $u^3$ doesn’t notice the shift. Under all six permutations of the roots $u^3$ takes only two values. Two values are the roots of a quadratic equation whose coefficients are symmetric in the roots and are expressed in terms of the coefficients of the original. A square root gives $u^3$, a cube root gives $u$, and the roots are assembled from such numbers. First a square root, then a cube root: that’s exactly how Cardano’s formula is built. For degree five Lagrange’s best expressions took six values, and the auxiliary equation turned out to have degree six.

Galois took the next step. Instead of hunting for lucky expressions in the roots, he proposed studying all the permutations of the roots at once, or rather those that break none of the relations between them.

The equation $x^2 - 2 = 0$ has roots $\pm\sqrt2$, and swapping them spoils nothing: the relations $x_1 + x_2 = 0$ and $x_1^2 = 2$ stay true after the swap. The Galois group consists of two permutations. The equation $(x^2 - 2)(x^2 - 3) = 0$ has roots $\sqrt2, -\sqrt2, \sqrt3, -\sqrt3$, and here the choice is already limited: the relation $x_1^2 = 2$ forbids sending $\sqrt2$ to the place of $\sqrt3$. The equation $x^4 + x^3 + x^2 + x + 1 = 0$ has as roots the powers of the number $\zeta = \cos 72^\circ + i\sin 72^\circ$: $\zeta, \zeta^2, \zeta^3, \zeta^4$. Relations like “the second root is the square of the first” bind them so tightly that a symmetry is determined by a single choice, where to send $\zeta$, and the group has four elements. And for the “general” quintic, where there are no special relations between the roots, all $5! = 120$ permutations belong to the group.

The roots of the equation $(x^2 - 2)(x^2 - 3) = 0$ are the numbers $\pm\sqrt2$ and $\pm\sqrt3$. Can a permutation in the Galois group swap $\sqrt2$ and $\sqrt3$?

It can: all four roots are irrational and nothing distinguishes them It can’t: the square of the first is $2$, and the square of the second is $3$ It can, if $-\sqrt2$ and $-\sqrt3$ are swapped at the same time

The relation $x_1^2 - 2 = 0$ with rational coefficients holds for $x_1 = \sqrt2$. If $\sqrt2$ is sent to the place of $\sqrt3$, it turns into $(\sqrt3)^2 - 2 = 0$, which is false. Each root can be replaced only by a root of the same factor: $\sqrt2$ by $\pm\sqrt2$, $\sqrt3$ by $\pm\sqrt3$.

How many permutations are there in the Galois group of the equation $(x^2 - 2)(x^2 - 3) = 0$?

The root $\sqrt2$ can be left in place or sent to the place of $-\sqrt2$, and the same can be done, independently, with $\sqrt3$: that gives $2 \cdot 2 = 4$ permutations. All of them qualify. Any relation with rational coefficients between $\pm\sqrt2, \pm\sqrt3$, once the brackets are multiplied out, can be written as $A + B\sqrt2 + C\sqrt3 + D\sqrt6 = 0$ with rational $A, B, C, D$, and such an equation is possible only if all four numbers are zero (this is proved in the same way as the irrationality of $\sqrt2$). Changing the sign of $\sqrt2$ changes the signs of $B$ and $D$ and keeps the zeros; the same with $\sqrt3$.

Galois’s main theorem says that whether an equation is solvable by radicals depends only on how this group is built. Before stating it, let’s see where the group comes from in real life and why radicals are connected with it. For that we’ll set the roots in motion.

The braid of roots

In chapter 14 we moved the roots and watched the coefficients change. Let’s do the opposite: move a coefficient. Take the equation $x^5 - 5x = z$ and regard $z$ as a point of the complex plane. For each $z$ the equation has five roots counted with multiplicity (the fundamental theorem of algebra). As $z$ moves, the roots move too, and continuously: a small shift in $z$ shifts each simple root only a little. Rigorously, this follows from the argument principle (chapter 34): the number of roots inside a small circle doesn’t change as long as $z$ changes only a little.

The roots can’t disappear, but they can collide. Two roots merge when the derivative $5x^4 - 5$ vanishes along with the polynomial $x^5 - 5x - z$, that is, at $x = \pm1$ or $x = \pm i$. Substituting these $x$, we get four special values: $z = 4, 4i, -4, -4i$. At all other points of the plane the five roots are distinct.

The main observation: if $z$ goes away, goes round a special point and comes back, then five roots of the same equation are in place again, but each may have come to where another stood before. The loop has permuted the roots. This phenomenon has a name.

Label the roots at $z = 0$. The equation $x^5 - 5x = 0$ is solved at once: $x(x^4 - 5) = 0$, so $x_1 = \sqrt[4]{5} \approx 1.495$, $x_2 = i\sqrt[4]{5}$, $x_3 = -\sqrt[4]{5}$, $x_4 = -i\sqrt[4]{5}$ and $x_5 = 0$. Call loop $a$ the path from zero in a straight line almost to the point $4$, round it by a small circle anticlockwise, and back the same way. Likewise the loops $b$, $c$, $d$ go round the points $4i$, $-4$ and $-4i$. We write permutations as cycles: $(3\;5)$ is the swap of $x_3$ and $x_5$; $(1\;3\;5)$ means $x_1$ goes to the place of $x_3$, $x_3$ to the place of $x_5$, and $x_5$ to the place of $x_1$.

The trick is to take one loop apart in detail and get the rest from it by rotating the plane. At the top right is the $z$-plane; the main picture shows the roots.

At $z = 0$ the roots stand at the centre and at the vertices of a square: $x_5 = 0$, and $x_1, x_2, x_3, x_4$ are $\sqrt[4]5$, $i\sqrt[4]5$, $-\sqrt[4]5$, $-i\sqrt[4]5$. Move $z$ along the real axis from $0$ to $4$. The real roots are the points where the graph $y = x^5 - 5x$ crosses the line $y = z$. On the interval $[-1, 1]$ the function decreases from $4$ to $-4$, and to the left of $-1$ it increases, so $x_5$ creeps left from zero, and $x_3$ right from $-\sqrt[4]5$. At $z = 4$ they meet at the point $-1$: $x^5 - 5x - 4 = (x + 1)^2(x^3 - 2x^2 + 3x - 4)$. Go round the point $4$ by a small circle. Near $x = -1$ the equation has the form $(x + 1)^2 h(x) = z - 4$, where $h(x) = x^3 - 2x^2 + 3x - 4$ and $h(-1) = -10 \ne 0$. After the substitution $u = (x + 1)\sqrt{h(x)}$ (near $-1$ this is a one-to-one correspondence) it turns into $u^2 = z - 4$. While $z$ goes round $4$, the argument of the number $z - 4$ grows by $2\pi$, and the argument of $u$ by $\pi$ (chapter 15): the two values $u = \pm\sqrt{z - 4}$, and with them the two roots near $-1$, swap places. The other three roots are simple at $z = 4$ and only trace small loops round their places. Return to zero the same way. The roots $x_3$ and $x_5$ have swapped places, and the rest have come back to their own: loop $a$ gives the permutation $(3\;5)$. If $x$ is a root of the equation with coefficient $z$, then $ix$ is a root of the equation with coefficient $iz$, because $(ix)^5 - 5(ix) = i(x^5 - 5x)$. A rotation by $90^\circ$ takes loop $a$ to loop $b$, and the roots $x_3, x_5$ to $x_4, x_5$: loop $b$ gives $(4\;5)$. Two more rotations give $c = (1\;5)$ and $d = (2\;5)$. A swap of any two roots is obtained from these: $(i\;j) = (i\;5)(j\;5)(i\;5)$; the root $x_i$ goes to the place of $x_5$, from there to the place of $x_j$, while $x_j$ comes to the place of $x_i$ via the place of $x_5$. Any permutation is a few swaps in a row, transpositions (chapter 40). Going round the corresponding loops one after another, we get any permutation of the five roots.

The roots of the equation $x^5 - 5x = z$ can be permuted any way you like by leading $z$ round loops. This is the Galois group seen in motion: each loop gives a permutation that preserves all the relations between the roots, and in our case these are all $120$ permutations.

Radicals and commutators

Now let’s look at what loops do not to roots but to radicals. Go round loop $a$ and follow $\sqrt{z - 4}$: start from one of its two values and change it continuously. The argument of $z - 4$ grows by $2\pi$, the argument of the root by $\pi$, and the root comes back multiplied by $-1$. But along loop $b$ the number $z - 4$ doesn’t go round zero, and the root comes back to itself. The same in general: if an expression $E$ returns to its previous value after going round a loop, then $\sqrt[n]{E}$ can change only by being multiplied by an $n$th root of unity, since the end and the start have the same $n$th power.

Arnold’s main trick is to go round two loops and then both backwards.

The commutator of loops $\gamma$ and $\delta$ is the loop $[\gamma, \delta] = \gamma\delta\gamma^{-1}\delta^{-1}$: go round $\gamma$, then $\delta$, then $\gamma$ backwards, then $\delta$ backwards. It’s the same commutator that was used in chapter 40 to build algorithms for the Rubik’s cube: $R\,U\,R'\,U'$. For permutations $[\sigma, \tau] = \sigma\tau\sigma^{-1}\tau^{-1}$. One caveat about order: in chapter 40 the notation $ab$ meant “first $b$, then $a$”, but with loops it’s more convenient to carry out permutations in the order they’re written, left to right, like loops travelled in succession or moves of the cube. We’ll do so until the end of the chapter.

If $\sigma$ and $\tau$ commute, then $[\sigma, \tau]$ changes nothing: everything done is undone. The commutator measures how far two operations fail to commute. For example, loops $a$ and $c$ give the swaps $(3\;5)$ and $(1\;5)$, and their commutator $[a, c]$ is the three-cycle $(1\;3\;5)$.

Find the commutator $[(1\;2),\ (2\;3)]$ of permutations of the numbers $1, 2, 3$ (carried out left to right). Write the answer as a cycle, for example “(1 3 2)”.

Each swap is its own inverse, so $[\sigma, \tau] = \sigma\tau\sigma\tau = (\sigma\tau)^2$. First $\sigma\tau$: the number $1$ goes to $2$, then to $3$; the number $3$ stays put, then goes to $2$; the number $2$ goes to $1$ and stays there. We get $\sigma\tau = (1\;3\;2)$. Twice this cycle gives $(1\;2\;3)$: $1 \to 3 \to 2$, $2 \to 1 \to 3$, $3 \to 2 \to 1$. Answer: $(1\;2\;3)$.

Call any loops beginning and ending at the chosen point loops of level $0$, the commutators of two loops of level $0$ loops of level $1$, the commutators of two loops of level $1$ loops of level $2$, and so on. Call the depth of an expression the number of storeys of radicals in it: $\sqrt{z^2 - 16}$ has depth $1$, $\sqrt[3]{z + \sqrt{z^2 - 16}}$ depth $2$, and an expression without radicals $0$.

To prove there’s no formula, it remains to find loops of arbitrarily high level that still permute the roots. For this we need one fact about permutations of five elements.

Let’s check the equation by moving counters: a permutation moves the counter from place $p$ to the place it sends $p$ to.

Arrange five places at the vertices of a pentagon and put on each place a counter with the same letter. Carry out $\sigma = (x\;u\;z)$: the counter from place $x$ goes to $u$, from $u$ to $z$, from $z$ to $x$. Carry out $\tau = (x\;v\;y)$: from place $x$ to $v$, from $v$ to $y$, from $y$ to $x$. Carry out $\sigma^{-1} = (x\;z\;u)$, the same cycle backwards. Carry out $\tau^{-1} = (x\;y\;v)$. Counter $x$ travelled $x \to u \to u \to x \to y$, counter $y$ travelled $y \to y \to x \to z \to z$, counter $z$ travelled $z \to x \to v \to v \to x$, and counters $u$ and $v$ came home. The commutator sent $x$ to the place of $y$, $y$ to the place of $z$, and $z$ to the place of $x$: that’s $(x\;y\;z)$.

For four elements the trick doesn’t work: the equation involves five different letters, and the fifth is essential. It’s exactly here, as we’ll see, that the border between degree four and degree five runs.

There’s no formula

Everything is ready for the main theorem. We’ll prove even more than the absence of a general formula: for one particular equation with one moving coefficient, the roots aren’t expressed in radicals in terms of that coefficient.

The idea: a formula of depth $k$ has to return after a loop of level $k$, but the root it follows doesn’t have to.

Suppose such an expression $F$ exists and has depth $k$. Take a point $z_0$ in the disc where no denominator and no expression under a root in $F$ vanishes. We’ll start loops at $z_0$: go from $z_0$ to zero, go round the loops we need, and return the same way. So from $z_0$ too any permutation of the roots can be reached, and the corollary on loops of any level still holds. The value $F(z_0)$ is one of the roots. Choose a three-cycle that moves this root to the place of another, and a loop $\Gamma$ of level $k$ that permutes the roots by this cycle. Go round $\Gamma$, changing the values of all the radicals in $F$ continuously. The equation $F^5 - 5F - z = 0$, true near $z_0$, stays true along the whole path: that’s how analytic continuation works (chapter 34). So $F$ equals one of the roots at every moment. The roots on the path are distinct and change continuously, so $F$ keeps following the same root throughout and at the end is at its new place, where another root was before. The value of $F$ has changed. But $F$ has depth $k$, and by the corollary on storeys of radicals it returns to its previous value after a loop of level $k$. A contradiction: there’s no such expression. A general formula for the equations $x^5 + a_4x^4 + \dots + a_0 = 0$, after substituting $a_4 = a_3 = a_2 = 0$, $a_1 = -5$, $a_0 = -z$, would give exactly such an expression, so there’s none of that either.

Two technical details we skipped

The first. Along the path of a loop some expression under a root in $F$ might vanish, and then the continuous continuation of the radical is ambiguous. Every expression in radicals is an algebraic function of $z$, and in any bounded piece of the plane it has finitely many such points. The loops can be bent slightly to go round them; the permutation of the roots won’t change as long as the bend doesn’t catch the special points $\pm4, \pm4i$. All the arguments above are carried out for the bent loops.

The second. A general formula might “break” precisely on our family: for example, divide by an expression that vanishes when $a_4 = a_3 = a_2 = 0$. Then shift the family: take $x^5 + \varepsilon_4x^4 + \varepsilon_3x^3 + \varepsilon_2x^2 - (5 - \varepsilon_1)x = z$ with small $\varepsilon_i$ chosen so that the formula doesn’t break. The special points move only a little, the loops permute the roots in the same way, and the proof goes through unchanged. Arnold, for his part, argued directly in the space of all five coefficients. A detailed account is in V. B. Alekseev’s book Abel’s Theorem in Problems and Solutions (1976), written from his lectures.

There’s no formula because radicals can only “tangle” commutatively. Each storey of radicals is untangled by one storey of commutators: an expression with $k$ storeys returns to itself after a loop of level $k$. But the roots of a quintic, if the coefficients are led round loops, are permuted any way at all, and in the group of all permutations of five elements the commutators never run out: a three-cycle is itself a commutator of three-cycles. No finite number of storeys is enough. For degrees $2$, $3$ and $4$ the commutators run out in one, two and three steps, and formulas exist. Exactly which quintics are solvable by radicals is determined by their Galois group.

Let’s check the last words on small degrees. For the quadratic the group of two permutations is commutative, and the very first step gives the identity permutation: one storey is enough, a square root. For the cubic the commutators of the six permutations of three roots are three-cycles, and their commutators are trivial: two storeys, a square root inside a cube root, as in Cardano. For four roots the commutators of all $24$ permutations form the $12$ even permutations, their commutators are just $4$ permutations (the identity and three double swaps like $(1\;2)(3\;4)$), and these $4$ commute with one another. Three steps, and that’s it. For five roots the step goes from $120$ permutations to the $60$ even ones (the alternating group $A_5$), and then the chain gets stuck: the commutators of the $60$ even permutations are again all $60$, since each three-cycle is a commutator of three-cycles, and three-cycles generate $A_5$.

Why doesn’t Arnold’s proof work for equations of degree four?

Quartic polynomials have no special points, and the roots aren’t permuted A three-cycle of four elements can’t be written as a commutator of three-cycles, and loops of high level stop permuting the roots For degree four, radicals don’t return after commutators Four roots can’t be placed at the vertices of a pentagon

There are special points, and loops permute the four roots any way at all. But the formula $(x\;y\;z) = [(x\;u\;z), (x\;v\;y)]$ has five different letters. For four elements the commutators of three-cycles are double swaps, and the commutators of double swaps are trivial. Loops of level $3$ no longer permute anything, and three storeys of radicals are enough for the quartic formula, if it’s written economically.

What Galois saw

Évariste Galois was born on 25 October 1811 in the small town of Bourg-la-Reine near Paris, where his father was mayor. At the Parisian Lycée Louis-le-Grand he was bored in rhetoric classes and, so the story goes, read Legendre’s Elements of Geometry, meant for two years of study, in two days. Soon he was reading Lagrange and Abel, and at seventeen he published his first paper.

After that everything went wrong. Twice, in 1828 and 1829, Galois failed the entrance examination for the École Polytechnique. The second failure came a few weeks after his father, hounded by the slanders of a local priest, took his own life; according to legend, at the examination Galois threw the board rubber at the examiner. He entered the École Normale and sent papers to the Academy of Sciences. The fate of the first manuscript, handed to Cauchy in 1829, isn’t entirely clear. The second, submitted for a prize in 1830, was taken home by the Academy’s permanent secretary, Fourier; in May he died, and the manuscript was lost. The third, submitted in January 1831, was read by Siméon Denis Poisson, who returned it in July with the verdict that the author’s arguments were “neither sufficiently clear nor sufficiently developed to allow us to judge their rigour”.

By then Galois was an ardent republican. At the beginning of 1831 he was expelled from the École Normale for a sharp letter about the director in a newspaper. In May he was arrested for a toast, raised with a knife in his hand at a banquet, to King Louis-Philippe, and acquitted. On 14 July of the same year he was arrested again, for wearing the uniform of the disbanded artillery of the National Guard, and sentenced to six months in prison. In the Sainte-Pélagie prison he went on working on his memoir. Here’s the main thing in it, in modern language.

We’ve just seen that the groups of permutations of two, three and four elements are solvable, while the group $S_5$ of all permutations of five elements isn’t, because already its subgroup of commutators (all $60$ even permutations) coincides with its own subgroup of commutators. Galois linked this to equations.

The idea of the proof, and why the whole of it isn’t here

Add radicals to the rational numbers one at a time and follow which permutations of the roots still preserve all the relations, now with coefficients in which the added radicals are allowed. Each new radical narrows the group to a subgroup, and if the roots of unity have already been added, the piece “cut off” is built like a commutative group: that’s the algebraic twin of the lemma on a radical and a commutator. When all the radicals of a formula have been added, the roots are expressed through known numbers, and the group has shrunk to the single identity permutation: a chain of steps with commutative pieces has led from the Galois group down to the identity, and such a chain exists exactly for solvable groups. Conversely, from such a chain of subgroups a chain of radicals is built with the help of Lagrange’s expressions from the section on symmetries. To carry this out carefully one needs the fundamental theorem of Galois theory on the correspondence between the subgroups of the group and the intermediate fields, and that’s a chapter of a textbook: see, for example, M. M. Postnikov’s Foundations of Galois Theory (1960) or Emil Artin’s lectures Galois Theory. We’ve proved Arnold’s version, which is enough to answer the big question.

The criterion also works where loops have nothing to turn into: for equations with numerical coefficients. Take $x^5 - 6x + 3 = 0$. The polynomial is irreducible over $\mathbb Q$: this follows from Eisenstein’s criterion for $p = 3$, which we’ll prove below. It has exactly three real roots: it changes sign on the intervals $[-2, -1]$, $[0, 1]$ and $[1, 2]$ (values $-17$ and $8$, $3$ and $-2$, $-2$ and $23$), and there can’t be more than three, because the derivative $5x^4 - 6$ vanishes only twice. Complex conjugation preserves all relations with rational coefficients, so it belongs to the Galois group; it swaps the two non-real roots and leaves the real ones alone: it’s a swap. The fundamental theorem of Galois theory implies that the group of an irreducible quintic also contains a cycle of length $5$. And a cycle of length $5$ together with a swap generate all $120$ permutations. The group is $S_5$, and the roots of $x^5 - 6x + 3 = 0$ can’t be expressed through radicals, although all five exist and are easy to find numerically.

Compass, straightedge and a power of two

In chapter 16 we stated the three problems of antiquity and put off the proof: with compass and straightedge you can’t double the cube, trisect the angle $60^\circ$, or construct a square equal to a circle. In chapter 6 the third problem was reduced to the lemma “constructible lengths are algebraic”. Galois himself didn’t work on constructions, but his language of fields and symmetries closed all three problems. The first to do so was Pierre Wantzel, in 1837.

There’s nothing to construct for the sum and difference: segments are laid off with a compass on one line. The product and quotient need similar triangles (chapter 17).

The segment $OA = a$ on the first ray. The segment $OB = b$ on the second ray. The constructed segment $OC$: the product. Example: with $a = 2.2$ and $b = 1.1$ we get $OC = 2.42$. If $b$ is laid off in place of the one, and one in place of $b$, we get $OC = \frac ab$. On one ray from $O$ lay off $OE = 1$ and $OA = a$, and on another $OB = b$. Draw the line $EB$. Through $A$ draw the line parallel to $EB$ (we know how to construct parallels with compass and straightedge, chapter 16). It meets the second ray at the point $C$. The triangles $OEB$ and $OAC$ are similar: they share the angle at $O$, and the angles at $E$ and $A$ are equal as corresponding angles for the parallel lines $EB$ and $AC$ and the transversal $OA$. So $\frac{OC}{OB} = \frac{OA}{OE}$. Hence $OC = OB \cdot \frac{OA}{OE} = b \cdot \frac{a}{1} = ab$. If $OE = b$ and $OB = 1$ are laid off instead, the same construction gives $OC = \frac ab$.

A square root is constructed by the theorem on the altitude of a right triangle.

The altitude of a right triangle dropped onto the hypotenuse. A piece of the hypotenuse of length $1$. A piece of the hypotenuse of length $a$. Example: with $a = 3$ we get $h = \sqrt3 \approx 1.732$. For $a = 2$ this constructs $\sqrt2$, and repeating the construction gives $\sqrt[4]2$. On a line lay off in succession $AH = 1$ and $HB = a$. Find the midpoint of $AB$ and construct the circle with diameter $AB$; the upper half is enough. Erect a perpendicular to $AB$ at the point $H$. It meets the semicircle at the point $P$; write $h = HP$. The angle $APB$ is a right angle: it’s inscribed in the circle and stands on a diameter (Thales’ theorem). The triangles $AHP$ and $PHB$ are similar. Both are right-angled, and the acute angles at $A$ and at $P$ are equal: $\angle HPB = 90^\circ - \angle B = \angle A$, because in the right triangles $PHB$ and $APB$ the acute angles add up to $90^\circ$. So $\frac{AH}{HP} = \frac{HP}{HB}$. Hence $HP^2 = AH \cdot HB$, that is, $h^2 = 1 \cdot a$ and $h = \sqrt a$.

So from the unit, compass and straightedge give everything that can be written in terms of rational numbers with the four operations and square roots: $\sqrt{2 + \sqrt3}$, $\sqrt[4]{2}$, $\frac{1 + \sqrt5}{2}$. It turns out that they give nothing more.

To deduce impossibility of constructions from this, we need a way of measuring how “far” a number is from the rationals. The degree serves this purpose.

For example, $[\mathbb Q(\sqrt2):\mathbb Q] = 2$: each number of this field is written uniquely as $p + q\sqrt2$ with rational $p, q$, and the minimal polynomial of $\sqrt2$ over $\mathbb Q$ is $x^2 - 2$.

Now two ancient problems are solved in a few lines.

The lemma from chapter 6 is proved along the way: a constructible number has finite degree, so it’s algebraic.

The first part of the answer is now fully proved. The side of a square equal in area to the unit disc is $\sqrt\pi$. If it were constructible, its degree over $\mathbb Q$ would be a power of two, in particular finite, and $\sqrt\pi$, and with it $\pi$, would be algebraic numbers. But $\pi$ is transcendental (Lindemann, 1882, chapter 6). With compass and straightedge it can’t be done. What can be done with a disc if you’re allowed to cut it into pieces is in chapter 54.

Find the degree $[\mathbb Q(\sqrt2 + \sqrt3):\mathbb Q]$.

The number $\sqrt3$ doesn’t lie in $\mathbb Q(\sqrt2)$: if $\sqrt3 = p + q\sqrt2$ with rational $p, q$, then $3 = p^2 + 2q^2 + 2pq\sqrt2$, so $pq = 0$; with $q = 0$ we get $\sqrt3 = p$, with $p = 0$ we get $\sqrt{3/2} = q$, and both numbers are irrational. So $[\mathbb Q(\sqrt2, \sqrt3):\mathbb Q] = 2 \cdot 2 = 4$ by the tower theorem. The number $s = \sqrt2 + \sqrt3$ generates this whole field: $\frac1s = \sqrt3 - \sqrt2$, so $\sqrt3 = \frac{s + 1/s}{2}$ and $\sqrt2 = \frac{s - 1/s}{2}$ lie in $\mathbb Q(s)$. Answer: $4$. The minimal polynomial is $x^4 - 10x^2 + 1$: from $s^2 = 5 + 2\sqrt6$ we get $(s^2 - 5)^2 = 24$.

The seventeen-gon

Euclid could construct the regular triangle, square, pentagon and fifteen-gon, and everything obtained from them by bisecting angles (chapter 16). For more than two thousand years the list didn’t grow. On 30 March 1796 the eighteen-year-old Göttingen student Carl Friedrich Gauss opened his mathematical diary with an entry saying that the circle could be divided into seventeen equal parts. It’s said that this discovery persuaded him to go into mathematics rather than philology. The result went into the Disquisitiones Arithmeticae (1801). Gauss computed, for example:

The sum of all sixteen $17$th roots of unity other than one itself. The first square root: at the first step the sixteen roots split into two groups of eight. The second storey: groups of four. The third and fourth storeys: groups of two and of one. Four nested square roots in all, because $16 = 2^4$. Check: $\sqrt{17} \approx 4.1231$, $\sqrt{34 - 2\sqrt{17}} \approx 5.0748$, $\sqrt{34 + 2\sqrt{17}} \approx 6.4997$, so the last term is $\approx 2\sqrt{11.2951} \approx 6.7216$. The sum is $\approx 14.9196$, so $\cos\frac{2\pi}{17} \approx 0.932472$, exactly what a calculator gives.

Where do the groups of eight, four and two come from? Gauss arranged the roots $\zeta^k$, $k = 1, \dots, 16$, where $\zeta = \cos\frac{2\pi}{17} + i\sin\frac{2\pi}{17}$, in an unusual order: by powers of three, $\zeta^1, \zeta^3, \zeta^9, \zeta^{10}, \zeta^{13}, \dots$ (the exponents $3^j$ taken modulo $17$). The sums of the roots taken every other one, every fourth one and so on, his “periods”, turn out at each step to be roots of quadratic equations with coefficients already known.

Which primes will do? Those for which $p - 1$ is a power of two. Fermat studied them long before.

In 1640 Fermat conjectured that all the numbers $2^{2^m} + 1$ are prime. In 1732 Euler found a divisor of the very next one: $2^{32} + 1 = 4{,}294{,}967{,}297 = 641 \cdot 6{,}700{,}417$. Since then all such numbers with $m$ from $5$ to $32$ have been checked, all composite, and it’s unknown whether there are any Fermat primes at all beyond the first five.

Find the smallest prime divisor of the number $2^{32} + 1$, the one Euler found. Hint: $641 = 5 \cdot 2^7 + 1 = 5^4 + 2^4$.

Answer: $641$. Let’s check that $641$ divides $2^{32} + 1$ with almost no computation. From $641 = 5^4 + 2^4$ we get $2^4 = 641 - 5^4$, so $2^{32} = 2^4 \cdot 2^{28} = 641 \cdot 2^{28} - 5^4 \cdot 2^{28} = 641 \cdot 2^{28} - (5 \cdot 2^7)^4$. And $5 \cdot 2^7 = 640 = 641 - 1$, and $(641 - 1)^4$ leaves remainder $(-1)^4 = 1$ on division by $641$. So $2^{32}$ leaves remainder $-1$, that is, $2^{32} + 1$ is divisible by $641$. There are no smaller prime divisors: if a prime $q$ divides $2^{32} + 1$, then $2^{32} \equiv -1$ and $2^{64} \equiv 1 \pmod q$, so the order of two modulo $q$ is $64$, and by Fermat’s little theorem $64$ divides $q - 1$ (chapter 41). Among the numbers $65, 129, 193, \dots, 577$ of the form $64k + 1$, only $193$, $257$, $449$ and $577$ are prime, and none of them divides $2^{32} + 1$.

Any power of two, including $2^0 = 1$: doubling the number of sides is bisecting the angles. Distinct Fermat primes, each at most once; for $m = 0$ the product is empty. Example: $51 = 3 \cdot 17$ is constructible; $9 = 3^2$ isn’t, three appears twice; $7$ isn’t, $7 - 1 = 6$ isn’t a power of two. The largest known constructible polygon with an odd number of sides has $3 \cdot 5 \cdot 17 \cdot 257 \cdot 65{,}537 = 4{,}294{,}967{,}295 = 2^{32} - 1$ sides.

For the proof we’ll need a convenient test of irreducibility.

The trick is to reduce everything to primes and their squares, and for a prime $p$ to study the field generated by the number $\zeta = \cos\frac{2\pi}{p} + i\sin\frac{2\pi}{p}$. Constructing an $n$-gon is the same as constructing the angle $\frac{2\pi}{n}$.

The reduction. If an $n$-gon has been constructed and $d$ divides $n$, then a $d$-gon has been constructed too: take every $\frac nd$th vertex. If an $a$-gon and a $b$-gon with coprime $a, b$ have been constructed, then an $ab$-gon has too: by Bézout’s identity (chapter 4) $1 = ua + vb$ with integer $u, v$, so $\frac{2\pi}{ab} = u \cdot \frac{2\pi}{b} + v \cdot \frac{2\pi}{a}$, and angles can be laid off and added with a compass. Bisecting an angle doubles the number of sides. So it’s enough to find for which odd primes $p$ the $p$-gon can be constructed, and to check that the $p^2$-gon never can. The number $\zeta$ is a root of the polynomial $\Phi_p(x) = \frac{x^p - 1}{x - 1} = x^{p-1} + \dots + x + 1$. It’s irreducible: for $\Phi_p(x + 1) = \frac{(x + 1)^p - 1}{x} = x^{p-1} + \binom{p}{p-1}x^{p-2} + \dots + \binom p2 x + p$ all the coefficients except the leading one are divisible by $p$ (in $\binom pk = \frac{p!}{k!(p-k)!}$ the factor $p$ of the numerator isn’t cancelled by anything for $1 \le k \le p - 1$), while the constant term $p$ isn’t divisible by $p^2$, and Eisenstein’s criterion applies. If the $p$-gon is constructible, the coordinates of its vertices lie in a field $K_m$ of a chain of square roots, $\zeta \in K_m(i)$, and by the tower theorem and the lemma on the minimal polynomial $p - 1 = [\mathbb Q(\zeta):\mathbb Q]$ divides $2^{r+1}$. So $p = 2^k + 1$. Moreover, $k$ is a power of two: if $k = qt$ with odd $q > 1$, then $2^k + 1 = (2^t)^q + 1$ is divisible by $2^t + 1$, because $y^q + 1 = (y + 1)(y^{q-1} - y^{q-2} + \dots + 1)$ for odd $q$. So $p$ is a Fermat prime. The square of a prime. The number $\cos\frac{2\pi}{p^2} + i\sin\frac{2\pi}{p^2}$ is a root of the polynomial $\Phi_{p^2}(x) = 1 + x^p + x^{2p} + \dots + x^{(p-1)p}$ of degree $p(p-1)$. It’s irreducible by Eisenstein too: the constant term of $\Phi_{p^2}(x + 1)$ is $\Phi_{p^2}(1) = p$, and the other coefficients are divisible by $p$. Indeed, in remainders on division by $p$ we have $(x + 1)^p \equiv x^p + 1$, hence $(x + 1)^{p^2} - 1 \equiv x^{p^2}$ and $(x + 1)^p - 1 \equiv x^p$, and the equation $\Phi_{p^2}(x + 1)\bigl((x + 1)^p - 1\bigr) = (x + 1)^{p^2} - 1$ gives $\Phi_{p^2}(x + 1) \equiv x^{p^2 - p}$. The degree $p(p - 1)$ is divisible by the odd $p$ and can’t be a power of two: the $p^2$-gon can’t be constructed. Necessity is proved. Sufficiency. Let $p = 2^s + 1$ be a Fermat prime. The numbers $\zeta, \zeta^2, \dots, \zeta^{p-1}$ form a basis of $\mathbb Q(\zeta)$ over $\mathbb Q$: by the lemma on the minimal polynomial the basis is $1, \zeta, \dots, \zeta^{p-2}$, and $1 = -(\zeta + \zeta^2 + \dots + \zeta^{p-1})$. So each $x \in \mathbb Q(\zeta)$ is written uniquely as $\sum_{k=1}^{p-1} c_k\zeta^k$ with rational $c_k$. For $t$ from $1$ to $p - 1$ put $\sigma_t\bigl(\sum c_k\zeta^k\bigr) = \sum c_k\zeta^{tk}$. The exponents $tk$ modulo $p$ run through the same numbers $1, \dots, p - 1$, so $\sigma_t$ permutes the basis; it preserves sums by definition. It preserves products too: it’s enough to check on the basis, and $\zeta^k\zeta^l = \zeta^{k+l}$ goes to $\zeta^{t(k+l)} = \zeta^{tk}\zeta^{tl}$; and if $k + l$ is divisible by $p$, then $\zeta^k\zeta^l = 1 = -\sum\zeta^j$, and $\sigma_t(1) = -\sum\zeta^{tj} = 1 = \zeta^{tk}\zeta^{tl}$. Find a primitive root $g$ modulo $p$, a number whose powers give all the remainders $1, \dots, p - 1$. There are at most $2^{s-1}$ remainders $a$ with $a^{2^{s-1}} \equiv 1$: they’re roots of a polynomial of degree $2^{s-1}$ over the field $\mathbb Z_p$, and a non-zero polynomial has at most as many roots as its degree (the proof from chapter 14 goes through in any field). So there’s an $a$ with $a^{2^{s-1}} \not\equiv 1$, while by Fermat’s little theorem $a^{2^s} = a^{p-1} \equiv 1$. The order of $a$ divides $2^s$ but not $2^{s-1}$, that is, it’s $2^s = p - 1$, and $g = a$ will do. Put $\sigma = \sigma_g$: then $\sigma^j = \sigma_{g^j}$, and the powers of $\sigma$ give all the $\sigma_t$. Let $F_j$ be the numbers $x \in \mathbb Q(\zeta)$ with $\sigma^{2^j}(x) = x$. These are fields, because $\sigma$ preserves the operations, and $F_0 \subset F_1 \subset \dots \subset F_s$; $F_s = \mathbb Q(\zeta)$, because $\sigma^{2^s} = \sigma^{p-1}$ is the identity map. The field $F_0$ consists of rational numbers: if $\sigma(x) = x$, then the coefficients $c_k$ are equal along the chain $k \to gk \to g^2k \to \dots$, which passes through all the exponents, and $x = c\sum\zeta^k = -c$. Take $x \in F_{j+1}$ and $y = \sigma^{2^j}(x)$. Then $\sigma^{2^j}(y) = \sigma^{2^{j+1}}(x) = x$, so $x + y$ and $xy$ don’t change under $\sigma^{2^j}$ and lie in $F_j$. The number $x$ is a root of the equation $t^2 - (x + y)t + xy = 0$ with coefficients from $F_j$, that is, it’s obtained from $F_j$ by a single square root. Climbing from $F_0 = \mathbb Q$ to $F_s = \mathbb Q(\zeta)$, we get $\zeta$ from rational numbers by the four operations and $s$ square roots of complex numbers. The square root of a point of the plane is constructed by bisecting an angle and taking the root of a length, so the point $\zeta$, and with it the $p$-gon, is constructible. Together with the reduction this proves the theorem. For $p = 17$ there are four steps: the very four storeys of roots in Gauss’s formula.

Which of these regular polygons can be constructed with compass and straightedge?

The $9$-gon The $25$-gon The $51$-gon The $63$-gon

$51 = 3 \cdot 17$ is a product of two distinct Fermat primes. The $51$-gon itself is obtained like this: Bézout’s identity $1 = 6 \cdot 3 - 17$ gives $\frac{2\pi}{51} = 6 \cdot \frac{2\pi}{17} - \frac{2\pi}{3}$.

Three levels of problems will help you practise: which polygons can be constructed, what the degree of a number over $\mathbb Q$ is, and whether a segment of a given length is constructible. All the course’s trainers are collected on the practice page.

Gauss showed which polygons can be constructed but left no ready instructions. The most elegant scheme for the seventeen-gon was published in 1893 by the English mathematician Herbert Richmond. You can check that it works numerically, or with the algebra of Gauss’s periods.

The debt from chapter 14

In chapter 14 we met the irreducible case: the equation $x^3 = 15x + 4$ has three real roots, yet Cardano’s formula needs $\sqrt{-121}$. We promised there to prove that complex numbers can’t be avoided: such roots can’t be expressed by real radicals. Now we have everything we need.

The idea, promised in chapter 14: look at the moment when a root appears for the first time, and see that all three roots appear with it, and with them a non-real cube root of unity, in the middle of the real numbers.

Let’s simplify the chain. Dividing $f$ by its leading coefficient, write $f = x^3 + bx^2 + cx + e$. A root of degree $ab$ is a root of degree $a$ of a root of degree $b$, so all the exponents $n_i$ can be taken to be prime, and $\alpha_i \notin K_i$ (otherwise the step adds nothing). The roots $x_1, x_2, x_3$ of $f$ are distinct: a multiple root would also be a root of the derivative, and $f$ has no common factors with $f'$, since $f$ is irreducible. So the discriminant $D = \bigl((x_1 - x_2)(x_1 - x_3)(x_2 - x_3)\bigr)^2$ is positive; it’s symmetric in the roots and therefore rational. Add $\sqrt D$ at the start of the chain; all the fields stay inside $\mathbb R$. The polynomial $f$ is irreducible over $\mathbb Q$: a cubic without roots in a field is irreducible. So each of its roots has degree $3$ over $\mathbb Q$, and there’s no root in $\mathbb Q(\sqrt D)$, whose degree is at most $2$. Let $K_{i+1}$ be the first field of the chain containing a root, say $x_1$. Write $K = K_i$, $L = K_{i+1} = K(\alpha)$, $\alpha^p = a \in K$ with a prime $p$. There are no roots in $K$, so $f$ is irreducible over $K$ too, and $[K(x_1):K] = 3$. The polynomial $x^p - a$ is irreducible over $K$. Its roots are $\alpha\varepsilon^j$, where $\varepsilon^p = 1$. If it were divisible by a polynomial of degree $d$, $0 < d < p$, with coefficients from $K$ and leading coefficient $1$, then the constant term of the divisor, $c = \pm\alpha^d\varepsilon^l$, would lie in $K \subset \mathbb R$, and $|c| = |\alpha|^d \in K$. Taking integers $u, v$ with $ud + vp = 1$, we’d get $|\alpha| = |\alpha|^{ud}\,|\alpha|^{vp} = |c|^u\,|a|^v \in K$, and so $\alpha = \pm|\alpha| \in K$, a contradiction. Hence $[L:K] = p$. By the tower theorem $3 = [K(x_1):K]$ divides $p$, so $p = 3$ and $L = K(x_1)$. All three roots lie in the field $L = K(x_1)$. By Vieta $x_2 + x_3 = -b - x_1$, and $x_2 - x_3 = \frac{\pm\sqrt D}{(x_1 - x_2)(x_1 - x_3)} = \frac{\pm\sqrt D}{f'(x_1)}$, with $\sqrt D \in K$. So $x_2, x_3 \in K(x_1)$. Let’s build a symmetry. Each element of $L = K(x_1)$ is written uniquely as $u + vx_1 + wx_1^2$ with $u, v, w \in K$. Put $\sigma(u + vx_1 + wx_1^2) = u + vx_2 + wx_2^2$. $\sigma$ preserves sums, and products too, because when multiplying we lower the degree with the substitution $x_1^3 = -bx_1^2 - cx_1 - e$, and exactly the same equation holds for $x_2$. So $\sigma$ preserves all the operations, doesn’t touch $K$, and takes $x_1$ to $x_2 \ne x_1$. Apply $\sigma$ to $\alpha$: $\sigma(\alpha)^3 = \sigma(\alpha^3) = \sigma(a) = a$. So $\sigma(\alpha) = \varepsilon\alpha$, where the number $\varepsilon = \frac{\sigma(\alpha)}{\alpha}$ lies in $L$ and $\varepsilon^3 = 1$. If $\varepsilon = 1$, then $\sigma$ doesn’t touch $\alpha$, and with it the whole field $L = K(\alpha)$, including $x_1$; but $\sigma(x_1) = x_2$. So $\varepsilon \ne 1$ is a non-real cube root of unity, $-\frac12 \pm \frac{\sqrt3}{2}i$. But it lies in the field $L$, made of real numbers. A contradiction: a root of $f$ can’t be expressed by real radicals, and the imaginary numbers in Cardano’s formula for the irreducible case are unavoidable.

The duel

In March 1832 cholera broke out in Paris, and Galois was transferred from prison to a nursing home. There he apparently fell in love with Stéphanie-Félicie Poterin du Motel; drafts of his letters to her survive, along with her replies asking him to stop. What happened next is still unclear. On 29 May Galois wrote letters to his republican friends: he was dying, he wrote, “the victim of an infamous coquette”. Who his opponent was, and whether the duel was a matter of honour or a trap, historians still argue. Early in the morning of 30 May Galois was mortally wounded in the stomach. He was found and taken to the Cochin hospital, where he died on the morning of 31 May. According to his brother Alfred, Galois said to him: “Don’t cry, I need all my courage to die at twenty.”

Chevalier printed the letter in the same year, 1832, but few understood it. Ten years later Joseph Liouville read the manuscripts, reported on them to the Academy in 1843, and published them in his journal in 1846. A quarter of a century later Camille Jordan set out Galois theory in his Treatise on Substitutions (1870), and it entered the textbooks. The word “group” in mathematics comes from Galois. Today groups describe the symmetries of crystals and elementary particles, the moves of the Rubik’s cube (chapter 40) and the structure of ciphers, and “what’s the group?” is the first question asked on meeting any new structure.

Where next

Galois worked out which numbers can be expressed through radicals and which segments can be constructed. But both Gauss and Euler loved other numbers most of all: the primes. In chapter 3 we saw the guess Gauss made as a teenager: up to $x$ there are roughly $\frac{x}{\ln x}$ primes. It was proved only in 1896, and the road led through a complex plane like the one we led $z$ across, through Bernhard Riemann’s function $\zeta(s) = 1 + \frac1{2^s} + \frac1{3^s} + \dots$ How accurate Gauss’s formula is, where its error hides, and why the size of the error depends on where the zeros of a single function lie, is in chapter 44.