Gauss and the regular 17-gon: one morning, a two-thousand-year-old problem

On March 30, 1796, a young man still a month short of turning nineteen worked out something no one had managed in the two thousand years since Euclid - drawing the regular 17-gon with only a straightedge and compass. But a deeper question than “drawing it” is:

Why can it be drawn?

This article starts from zero: Fermat primes, the clock modulo 17, Gauss periods, the Galois group, four layers of quadratic extensions, up to the explicit closed form of $\cos\frac{2\pi}{17}$ and Richmond’s twenty-step construction, and then on to Wantzel and Lindemann closing the door on the three great problems of ancient Greece.

Contents

• §0 Prologue
• §1 Why 17 (the Fermat prime criterion)
• §2 Multiplication on a clock (ℤ/17ℤ)*
• §3 Gauss periods → the first √17
• §4 The group of symmetries: Galois
• §5 The explicit closed form of cos(2π/17)
• §6 Richmond 1893: a twenty-step construction
• §7 Necessity: Wantzel + Lindemann
• §8 History and significance
• §9 Closing

§0 Prologue

The first entry of Gauss’s mathematical diary (Tagebuch), March 30, 1796 - the record of the discovery that the regular 17-gon is constructible (Latin Principia quibus innititur sectio circuli…). Wikimedia Commons, public domain.

In the Mediterranean world more than two thousand years ago, ancient Greece was a civilizational community made up of many city-states, and our philosophy, astronomy and geometry of today slowly took shape there.

My interest in mathematics came from plane geometry in junior high school. And what shook me most in it was the story of the young Gauss constructing the regular 17-gon.

The young Gauss, pastel by J. C. A. Schwartz, 1803 (Gauss about 26). Wikimedia Commons, PD.

In this episode, let us look back on this story together. Rather than “how to draw it”, what this blog post wants more to make clear is the thing Gauss really worked out back then - why it can be drawn.

§1 — Why 17: Fermat primes and the constructibility criterion

The regular 17-gon is a milestone in the history of mathematics not because “17 is a nice-looking number”, but because it lands exactly on an extremely demanding criterion: for the regular polygons that can be constructed exactly with an unmarked straightedge and a compass, the number of sides is held fast by a rare kind of prime called a “Fermat prime”. This section makes two things clear starting from zero - what kind of prime is “constructible”, and why $17$ happens to be one of them. We first use a plain picture to explain “Fermat numbers”, then fill in the complete proof of a key lemma (Gauss wrote it into the Disquisitiones Arithmeticae, but various popular accounts often pass over in a single stroke ”$2^m+1$ prime $\Rightarrow m$ is a power of $2$”), and finally explain the ins and outs of the criterion “constructible $\iff$ what the number of sides looks like”, and where each of the three great ancient Greek problems belongs with respect to it.

Additional notation for this section

1.1 Intuition first: what a Fermat number is, and why the exponent must be a “power of $2$”

The 17 roots of $z^{17}=1$ spread evenly around the unit circle; the real part of $\zeta_{17}=e^{2\pi i/17}$ (orange) is $\cos\frac{2\pi}{17}$. — Animation frame: Abel (Manim)

First look at the plainest question: among numbers of the form $2^m+1$, which can possibly be prime?

Try a few at random: $2^1+1=3$ (prime), $2^2+1=5$ (prime), $2^3+1=9=3\times3$ (not), $2^4+1=17$ (prime), $2^5+1=33=3\times11$ (not), $2^6+1=65=5\times13$ (not), $2^8+1=257$ (prime).

A pattern is ready to emerge: only when the exponent $m$ is itself a power of $2$ ($m=1,2,4,8,\dots$) does $2^m+1$ have a chance of being prime; as soon as $m$ carries an odd factor ($3,5,6$ all carry one), it can necessarily be factored.

The picture of this observation is like this: if an odd factor is hidden in $m$, then $2^m+1$ automatically “grows” a factor one size smaller, $2^{d}+1$, which splits it apart. On this basis Fermat in the seventeenth century conjectured: take $m=2^k$ (pinching off every odd factor completely), and the numbers obtained

are perhaps all prime. The first five are indeed beautiful:

$17=F_2=2^{2^{2}}+1$ is exactly the third Fermat prime among them - this is the arithmetic identity card that later lets it be constructed with straightedge and compass.

1.2 Making the intuition rigorous: $2^m+1$ is prime $\Rightarrow m$ is a power of $2$

The “pattern” of the previous subsection must be proved, or else it is only a coincidence. Here is a complete proof (Gauss, Disquisitiones Arithmeticae §365, builds the constructibility criterion on it). The entire fuel of the proof is the following elementary identity.

Lemma (factor of an odd power). Let $e$ be an odd number; then the polynomial $x+1$ divides $x^{e}+1$:

(Expand the right-hand side, and adjacent terms cancel in pairs, leaving only $x^{e}+1$; because $e$ is odd, the last term is $+1$, and the signs match exactly. Equivalently, $x=-1$ is a root of $x^{e}+1$, so $x+1$ is a factor of it.)

Proposition. If $2^{m}+1$ is prime, then $m$ is a power of $2$.

Proof (by contradiction). Suppose $m$ is not a power of $2$. Then $m$ contains at least one odd factor $e>1$. Write it as

Substitute $x=2^{d}$ in the lemma (note that $e$ is odd, so the lemma applies):

So $2^{d}+1$ is a factor of $2^{m}+1$. Now look at its size: because $1\le d<m$,

that is, $2^{d}+1$ is a proper factor lying strictly between $1$ and $2^{m}+1$. This contradicts $2^{m}+1$ being prime (having only the trivial factors $1$ and itself).

Therefore $m$ contains no odd factor $>1$, that is, $m$ is made up only of factors $2$ - $m$ is a power of $2$. (QED)

A reminder about direction (do not read it backwards): this proposition only says “prime $\Rightarrow$ the exponent is a power of $2$”; it

does not

guarantee “the exponent is a power of $2$ $\Rightarrow$ prime”. The reverse direction is where Fermat guessed wrong - see $F_5$ in the next subsection.

1.3 Fermat’s crash: $F_5$ is not prime (Euler 1732)

The Fermat primes $F_0\!=\!3,\,F_1\!=\!5,\,F_2\!=\!17,\,F_3\!=\!257,\,F_4\!=\!65537$; $F_5$ is struck out by Euler in 1732 with the factor 641. — Abel (Manim)

Fermat conjectured that “all $F_k$ are prime”, but he only checked up to $F_4$. About a century later, Euler** in 1732** gave the first counterexample: the sixth Fermat number

is not prime. Euler’s key insight was: if $F_5$ has a prime factor, that prime factor must be of the form $64k+1$ (this constraint greatly narrows the search range), and on this basis he soon pinned down $641$. The verification needs only one division:

($641$ is prime, and $6700417$ is also prime, but the latter was only confirmed later. $641=64\times10+1$, exactly of the form $64k+1$.) This stroke brought the “Fermat primes” down from “an infinite family” to a rare list of “only $5$ known at present”: $F_0,\dots,F_4 = 3,5,17,257,65537$. After $F_5$ nobody has ever found a new Fermat prime, and whether there is a sixth is unknown to this day.

It is exactly this rarity that determines that the “regular polygons with an odd prime number of sides” constructible with straightedge and compass can be counted on the fingers - and $17$ holds one of the places.

1.4 The constructibility criterion: the Gauss–Wantzel theorem

The Gauss–Wantzel criterion $n=2^a p_1\cdots p_k$ (distinct Fermat primes); the $7/9/11/13/14$-gons are out. — Abel (Manim)

F. J. Richelot (1808–1875), who constructed the regular 257-gon in 1832. Wikimedia Commons, public domain.

Now lay out in full the general criterion for “which regular polygons are constructible”. Its “sufficiency” (how to construct) was given by Gauss in 1796 by taking roots of periods (§3–§6 of this series do exactly the case $n=17$ from the beginning), and its “necessity” (if not satisfied, it really cannot be constructed) was completed by Wantzel** in 1837** (J. Math. Pures Appl. 2, 366–372). Together they are called:

The Gauss–Wantzel theorem.

The regular $n$-gon can be constructed exactly with straightedge and compass if and only if

$$n=2^{a}\,p_{1}p_{2}\cdots p_{k},$$

where $a\ge 0$, and $p_{1},\dots,p_{k}$ are

mutually distinct

Fermat primes ($k$ may be $0$).

To read this criterion, grasp three key points:

• “Mutually distinct” is a hard constraint. Among the constructible odd prime factors, each Fermat prime is used at most once. For example $n=9=3^{2}$ uses the Fermat prime $3$ repeatedly, and is not constructible - and this is exactly equivalent to ”$60^\circ$ cannot be trisected”. Go through this chain of equivalence: the regular nonagon requires constructing $40^\circ=\tfrac{1}{9}\cdot360^\circ$; and $40^\circ=2\times20^\circ$, doubling an angle is constructible, so “constructing $40^\circ$” and “constructing $20^\circ$” are the same thing; and $20^\circ=\tfrac{1}{3}\cdot60^\circ$, so it finally comes down to “can $60^\circ$ be trisected” - and $60^\circ$ itself is a readily constructible angle (the equilateral triangle), but trisecting it is not possible. The rigorous proof of this impossibility is left to §7.
• Multiplying by $2$ costs nothing. The factor $2^{a}$ can be added freely: if you can construct the regular $n$-gon, you can construct the regular $2n$-gon (bisect each arc, which needs only one perpendicular bisector). So the regular $3,5,15,17$-gons are constructible, and the regular $6,10,30,34,68$-gons are all constructible too.
• The list of constructible odd numbers of sides is extremely short. From the $5$ known Fermat primes $\{3,5,17,257,65537\}$ take several “mutually distinct” ones and multiply them, also counting “taking none at all” (the empty product $=1$, corresponding to $n$ being a pure power of $2$), and there are only $2^{5}=32$ combinations in total. Listing the odd numbers of sides other than the empty product $1$ gives $3,5,15,17,51,85,255,257,\dots$ ($15=3\times5$ slots in between $5$ and $17$). $17$ is the fourth smallest among them, and the first that is “non-trivial to the point of surprise” - this is exactly why Gauss shook the mathematical world back then (only after solving this problem, when not yet nineteen, did he decide to devote himself to mathematics).

1.5 The arithmetic heart of necessity: the degree must be a power of $2$

Why exactly Fermat primes in the criterion? This subsection gives the intuitive chain (for the complete proof see Wantzel’s degree criterion in §7); it translates “geometrically constructible” into “arithmetically, the exponent is a power of $2$”, connecting exactly back to §1.2.

Step one - turn geometry into coordinates. Put the regular $p$-gon into the unit circle with the first vertex pinned at $(1,0)$; then the adjacent vertex is $\big(\cos\frac{2\pi}{p},\sin\frac{2\pi}{p}\big)$. Constructing the regular $p$-gon $\iff$ constructing the real number $\cos\frac{2\pi}{p}$ (with this horizontal coordinate, the vertical coordinate $\sin$ is obtained from the equation of the unit circle by taking one square root, and the remaining vertices are copied by equal arcs). So the problem falls entirely onto whether one real number can be constructed.

Step two - the “degree” of a constructible number must be a power of $2$. Each straightedge-and-compass step (line meets line, line meets circle, circle meets circle) solves at most one quadratic equation in coordinates, that is, introduces at most one square root. Stringing the whole construction together, any constructible number $x$ lies at the top of a tower of extensions that is “quadratic at each layer”, and so its algebraic degree

must be a power of $2$ (this is the core of Wantzel 1837; §7 gives the rigorous argument by the tower multiplication formula).

Step three - compute the degree of $\cos\frac{2\pi}{p}$. For a prime $p$, it can be proved (§2 of this series has proved that $\zeta_{17}$, over $\mathbb{Q}$, has degree $=16$, and for a general prime the same argument gives $p-1$):

Step four - put it together. If the regular $p$-gon is constructible, then by steps two and three, $\dfrac{p-1}{2}$ must be a power of $2$, so $p-1$ is a power of $2$, that is, of the form $p=2^{m}+1$. And by the proposition of §1.2, $2^{m}+1$ being prime forces $m$ to be a power of $2$, so $p=2^{2^{k}}+1=F_k$ is a Fermat prime. This explains why the criterion must involve Fermat primes - they are the only arithmetic outlet for the geometric constraint “the degree is a power of $2$”.

Where the three great problems belong (please do not lump them together): Wantzel’s ruler of “the degree must be a power of $2$”

only

directly closes off

doubling the cube

(requires constructing $\sqrt[3]{2}$, degree $3$) and

trisecting an arbitrary angle

(e.g. $\cos20^\circ$ satisfies an irreducible cubic equation, degree $3$) - these two problems; both are out because “degree $3$” appears. But

squaring the circle

does not rest on Wantzel: it requires constructing $\sqrt{\pi}$, and the root of $\pi$‘s non-constructibility is that

Lindemann

** in 1882**

(

Math. Annalen 20, 213–225

) proved that

$\pi$ is transcendental

(not even an algebraic number, let alone constructible). So the full stop on the third problem was put down by Lindemann, not Wantzel. §7 will prove these three separately.

1.6 Worked examples: quickly deciding a few regular polygons with the criterion

Example 1.1 ($17=F_2$, constructible).

$17=2^{4}+1$, the exponent $4=2^{2}$ is a power of $2$, and $17$ is prime, so $17$ is the Fermat prime $F_2$. $\dfrac{17-1}{2}=8=2^{3}$ is a power of $2$ → the regular 17-gon is

constructible

.

Example 1.2 ($7$, not constructible).

$\dfrac{7-1}{2}=3$ is not a power of $2$; and $7=2^{m}+1$ has no integer solution ($7-1=6$ is not a power of $2$) → $7$ is not a Fermat prime → the regular heptagon is

not constructible

. Likewise for the regular $11,13$-gons: $(11-1)/2=5$ and $(13-1)/2=6$ are neither powers of $2$, so neither is constructible.

Example 1.3 ($9=3^{2}$, not constructible).

The odd prime factors of $9$ are the repeated Fermat prime $3\times3$, violating “mutually distinct” → the regular nonagon is

not constructible

(equivalent to $60^\circ$ not being trisectable: the regular nonagon requires constructing $40^\circ=2\times20^\circ$, and $20^\circ=60^\circ/3$).

Example 1.4 ($15=3\times5$, constructible).

$3=F_0$ and $5=F_1$ are two

different

Fermat primes, and the product satisfies the criterion → the regular 15-gon is

constructible

(already known to Euclid). Multiplying further by powers of $2$: the regular $30,60,120$-gons are all constructible too.

# §1 verification — pure stdlib, runs clean.
def is_power_of_two(n: int) -> bool:
    return n >= 1 and (n & (n - 1)) == 0

# 1) Fermat numbers F_k = 2**(2**k) + 1, and 17 = F_2.
F = [2 ** (2 ** k) + 1 for k in range(6)]
assert F[:5] == [3, 5, 17, 257, 65537]
assert F[2] == 17, "17 = F_2"

# 2) F_5 is composite (Euler 1732): a single trial division by 641 catches it.
assert F[5] == 4294967297
assert F[5] % 641 == 0
assert F[5] == 641 * 6700417
print(f"F_5 = {F[5]} = 641 x 6700417   (641 | F_5 in one division)")

# 3) Lemma engine: if 2**m + 1 is prime, then m is a power of 2.
#    Contrapositive: an odd factor e>1 of m (m=d*e) yields the proper
#    divisor 2**d + 1 of 2**m + 1, via  (x+1) | (x**e + 1)  with x = 2**d.
def proper_divisor_from_odd_factor(m: int):
    e = 3
    while e <= m:
        if m % e == 0:                      # e is an odd factor > 1
            d = m // e
            assert (2 ** m + 1) % (2 ** d + 1) == 0   # 2**d+1 divides 2**m+1
            assert 1 < 2 ** d + 1 < 2 ** m + 1        # and it is proper
            return 2 ** d + 1
        e += 2
    return None

for m in range(1, 40):
    val = 2 ** m + 1
    is_prime = val > 1 and all(val % q for q in range(2, int(val ** 0.5) + 1))
    witness = proper_divisor_from_odd_factor(m)
    if is_prime:
        assert witness is None and is_power_of_two(m)
print("Checked m=1..39:  2**m + 1 prime  =>  m is a power of 2")

# 4) Constructibility test via degree (p-1)/2 being a power of 2.
for p in [3, 5, 17, 257, 65537, 7, 11, 13]:
    deg = (p - 1) // 2          # = [Q(cos 2pi/p) : Q]
    verdict = "constructible" if is_power_of_two(deg) else "NOT constructible"
    print(f"  p={p:>5}:  (p-1)/2 = {deg:>5}  power of 2? {is_power_of_two(deg)!s:>5}  -> {verdict}")
print("OK")

The run output confirms: $F_5=641\times 6700417$ is broken by a single division; within $m=1\sim39$, whenever $2^{m}+1$ is prime its exponent is necessarily a power of $2$; $p=3,5,17,257,65537$ are constructible, and $p=7,11,13$ are not.

1.7 Modern significance

This criterion welds the most ancient of tools, “a straightedge and a compass”, to the language of fields and degrees of extensions that only matured in the nineteenth century, and its echoes go far beyond geometry itself:

• A problem of more than two thousand years, closed along two timelines. The three great ancient Greek construction problems (doubling the cube, trisecting the angle, squaring the circle), counted from about $450$ BC (Anaxagoras thinking about squaring the circle in prison), were only finally settled by Wantzel 1837 and Lindemann 1882, a span of about two thousand three hundred years. That is one line. The other line is the construction of regular polygons: after Euclid (about $300$ BC) gave the regular $3,5,15$-gons, the list of odd prime numbers of sides made no progress at all for over two thousand years, until Gauss added the regular 17-gon in 1796 - the two “millennial scales” refer to different things; do not merge them into one number.
• The rarity of Fermat primes is still an open frontier today. Apart from $F_0\sim F_4$, humanity has not found another Fermat prime to this day, and many Fermat numbers after $F_5$ have been verified to be composite; “are there only finitely many Fermat primes” is an unsolved mystery of number theory. This means that whether the list of “regular polygons with a constructible odd number of sides” is closed is, in essence, an open problem.
• The same criterion idea of “the degree is a power of $2$” is exactly the embryo of Galois theory (§4): translate a geometric/equation problem into a problem about the structure of groups and fields, and then read off the answer from “the number of layers of the tower”. This paradigm of “first translate, then use structure to decide possible or impossible” later governed the whole territory from the solution of algebraic equations by radicals (Abel–Galois) to modern computational complexity.

In the year he was not yet nineteen, Gauss used the regular 17-gon to show: sometimes the fastest path to answering “can it be done” is not to do it more cleverly, but to move the problem into an algebraic world where all the possibilities can be seen clearly - and $17=F_2$ is exactly the first pass that this world handed to geometry.

— End of §1.

§2 — Multiplication on a clock: $(\mathbb{Z}/17\mathbb{Z})^{*}$ and its generator

To understand how Gauss “took apart” the regular 17-gon, we first have to get to know a small algebraic world: multiplication modulo 17. This section starts from zero - it does not assume you have studied group theory. We will first use the picture of a clock to make the objects clear, then formalize it, and finally prove one key fact: by repeatedly multiplying with just one number, $g=3$, you can walk through all the nonzero remainders modulo 17. This property of “walking through everything” is the entire foundation for the layer-by-layer root-taking of the next three sections.

Additional notation for this section

2.1 The world modulo 17: a 17-hour clock

An ordinary clock has 12 hours, and after 12 it wraps around to 1. Change the number of hours to 17, and you get $\mathbb{Z}/17\mathbb{Z}$: all integers are classified by “their remainder on division by 17”, leaving only the 17 representatives $0,1,2,\dots,16$. After two numbers are added or multiplied, anything over 16 has a multiple of 17 subtracted to wrap it back. For example

The notation "$a\equiv b \pmod{17}$" is read ”$a$ is congruent to $b$ modulo 17”, meaning that they have the same remainder on division by 17 (they differ by a multiple of 17).

Why pick 17? Because 17 is prime - it has no factors other than 1 and itself. This guarantees something good: among $1,2,\dots,16$, any number can be “divided by” (each has a multiplicative inverse). For example, $5\times 7\equiv 1$ above shows that $7$ is the reciprocal of $5$. So these 16 nonzero remainders form a closed little world of their own under multiplication, written $(\mathbb{Z}/17\mathbb{Z})^{*}$. (If the modulus is not prime, for example modulo 6, then $2\times 3\equiv 0$, multiplication “falls out” of the nonzero set, and this good property is gone.)

2.2 “Order”: how long self-multiplication takes to return to 1

In this world of multiplication, pick a number and multiply it by itself repeatedly, and sooner or later you return to $1$ (because there are only finitely many values, it must cycle; and $1$ is certainly in the cycle). The number of times needed to return to $1$ for the first time is called the order $\operatorname{ord}(a)$ of the number.

Try it with $a=2$:

It took 8 steps to return to $1$, so $\operatorname{ord}(2)=8$. Note that the orbit of $2$, $\{2,4,8,16,15,13,9,1\}$, has only 8 numbers - it cannot walk through all 16.

2.3 The generator $g=3$: walking step by step over the whole clock face

The generator $g=3$: from 1, repeatedly $\times 3 \bmod 17$ walks in turn through all 16 nonzero remainders ($1\to3\to9\to10\to13\to\dots\to1$) and then returns to the start - the literal image of “generating”. — Animation: Abel (Manim)

Switch to $a=3$, and repeatedly $\times 3 \bmod 17$:

Keep walking, and the orbit is

the 16 numbers traverse $1$ to $16$ exactly, with no repeats and no omissions, and only at the 16th step does it return to $1$. That is, $\operatorname{ord}(3)=16$. A number like this, whose “self-multiplication can walk through the whole”, is called a generator (or primitive root): it is like the second hand of a clock; each jump of one notch (one $\times 3$), and $16$ jumps go exactly once around the clock face, stepping on every hour.

Compare the $2$ of 2.2 (which steps on only 8 points before returning early to the start), and you can feel intuitively what is special about a “generator”: not every number can generate; only one that can generate deserves to be called a primitive root. $g=3$ is the smallest primitive root modulo 17, and we use it throughout what follows.

This “renumbering the remainders by powers of $g$” is the

core trick

of the whole article. We do not look at these remainders in the natural order $1,2,3,\dots$, but line them up by which power of $g$ they are. We will see later: once this order of lining up is fixed, the symmetry of the regular 17-gon becomes a simple “shift of index”.

2.4 Making it rigorous: $(\mathbb{Z}/17\mathbb{Z})^{*}$ is a cyclic group of order 16, $\operatorname{ord}(3)=16$

Make the intuition above rigorous. “Order” has a basic property (the special case of Lagrange’s theorem in the cyclic situation): $\operatorname{ord}(a)$ must divide the number of elements of the group, $16$. So $\operatorname{ord}(3)$ can only be one of the divisors of $16$: $1,2,4,8,16$.

Proof. To prove $\operatorname{ord}(3)=16$, it suffices to rule out all the proper divisors $1,2,4,8$. Note that they all divide $8$, so ”$\operatorname{ord}(3)$ is some proper divisor” would imply $3^{8}\equiv 1$. So one only needs to check one condition, $3^{8}\not\equiv 1$, to rule out all the proper divisors at one stroke. Square repeatedly:

We get $3^{8}\equiv -1\neq 1$, so $\operatorname{ord}(3)\nmid 8$; combined with $\operatorname{ord}(3)\mid 16$, the only possibility is $\operatorname{ord}(3)=16$. (QED)

Since there exists an element of order $16$, the whole of $(\mathbb{Z}/17\mathbb{Z})^{*}$ is exhausted by its powers, that is, $(\mathbb{Z}/17\mathbb{Z})^{*}=\langle 3\rangle$ is a cyclic group, $(\mathbb{Z}/17\mathbb{Z})^{*}\cong \mathbb{Z}/16\mathbb{Z}$.

2.5 The key foundation: the degree of $\zeta_{17}$ over $\mathbb{Q}$ is exactly 16

All the later claims that “the symmetry group has 16 elements” and “each layer of extension has degree 2” hang on a fact that must be proved (not assumed): the lowest-degree equation with rational coefficients satisfied by $\zeta_{17}=e^{2\pi i/17}$ has degree exactly 16.

$\zeta_{17}$ is a root of $x^{17}-1=0$. Removing the factor $x-1$, it lies on the cyclotomic polynomial

We prove that $\Phi_{17}$ is irreducible over $\mathbb{Q}$ (it cannot be further decomposed into a product of polynomials of lower degree with rational coefficients). The trick is to substitute $x\mapsto x+1$ and then use the Eisenstein criterion:

Because $17$ is prime, all the middle binomial coefficients $\binom{17}{k}$ ($1\le k\le 16$) are divisible by $17$; the constant term is $\binom{17}{16}=17$, divisible by $17$ but not by $17^2=289$; the leading coefficient $1$ is not divisible by $17$. This satisfies the Eisenstein criterion exactly (with the prime $p=17$), so $\Phi_{17}(x+1)$ is irreducible, and hence $\Phi_{17}(x)$ is irreducible. Therefore

This step is the load-bearing wall of the whole piece: precisely because the degree is $16$, the “symmetry group” of $\zeta_{17}$ (the Galois group of §4) really has $16$ elements, and equals the whole of $(\mathbb{Z}/17\mathbb{Z})^{*}$ rather than some subgroup of it; otherwise all of the later ”$|G|=16=2^4$, four layers of quadratic extensions” would come to nothing. (Without this step, $\zeta_{17}$ could in principle satisfy an equation of lower degree, and the whole tower would collapse.)

2.6 Worked examples: generator vs non-generator

Example 2.1 ($g=3$ is a generator).

The length of the orbit of powers of $3$ $=\operatorname{ord}(3)=16$, traversing the whole of $\{1,\dots,16\}$ - see 2.3.

Example 2.2 ($g=2$ is not a generator).

The orbit of powers of $2$, $\{2,4,8,16,15,13,9,1\}$, has only $\operatorname{ord}(2)=8$ elements, missing $\{3,5,6,7,10,11,12,14\}$. Checking the order: $2^8=256=15\times 17+1\equiv 1$, and $2^4=16\equiv -1\neq 1$, so $\operatorname{ord}(2)=8\neq 16$.

**It walks only half the circle.

Example 2.3 (smaller orders).**

$\operatorname{ord}(16)=2$ (since $16\equiv -1$, $(-1)^2=1$); $\operatorname{ord}(4)=4$ ($4^2=16\equiv -1$, $4^4\equiv 1$). The smaller the order, the shorter the orbit, and the further from “generating”.

# Verify orders + that 3 is a primitive root mod 17; spot-check Phi_17 degree.
def order(a: int, n: int = 17) -> int:
    x, k = a % n, 1
    while x != 1:
        x = (x * a) % n
        k += 1
    return k

assert order(3) == 16,  "3 should be a primitive root (order 16)"
assert order(2) == 8,   "2 reaches only half"
assert order(4) == 4 and order(16) == 2
# 3 visits every nonzero residue exactly once:
assert {pow(3, k, 17) for k in range(16)} == set(range(1, 17))
print("ord(3)=16 primitive root; cycle =", [pow(3, k, 17) for k in range(16)])

# Phi_17 irreducible (proved via Eisenstein on Phi_17(x+1)) => [Q(zeta_17):Q] = 16.
# Cross-check the degree: deg Phi_17 = phi(17) = 16 (since 17 is prime, phi(17)=16),
# and confirm Eisenstein's hypotheses on Phi_17(x+1) hold at p=17.
from math import comb
# binomial coefficients C(17,k), k=1..16, are the non-leading coeffs of Phi_17(x+1):
mids = [comb(17, k) for k in range(1, 17)]
assert all(c % 17 == 0 for c in mids),         "all middle coeffs divisible by 17"
assert mids[-1] % (17**2) != 0,                 "constant term C(17,16)=17 not div by 17^2"
print("Eisenstein at p=17 holds on Phi_17(x+1)  =>  [Q(zeta_17):Q] = phi(17) = 16  [OK]")

2.7 Modern significance

“Repeated self-multiplication walking through the whole world of remainders” - the seemingly classical concept of the generator/primitive root is the heart of modern public-key cryptography:

• Diffie–Hellman key exchange (1976) is built precisely on, for a large prime $p$, a primitive root $g$: the two parties each take a secret exponent $a,b$, publicly exchange $g^a,g^b \bmod p$, and each then computes $g^{ab}$ as the shared key. The security comes from the discrete logarithm problem - given $g,\ g^a \bmod p$, recovering $a$ is computationally infeasible when $p$ is extremely large, even though the structure of $g$ “walking through” the whole guarantees that the values of $g^a$ are sufficiently uniform.
• The same “cyclic group + generator” structure also underpins ElGamal encryption, DSA digital signatures, and elliptic-curve cryptography (replacing the modular multiplicative group with the group of points on an elliptic curve, and the primitive root with a base point).

The cyclic structure of $(\mathbb{Z}/17\mathbb{Z})^{*}$ that Gauss studied in 1796 for a construction, and the mathematics that protects internet communications two centuries later, are the same object.

— End of §2.

§3 — Gauss periods: splitting the sixteen roots into two halves, forcing out the first $\sqrt{17}$

§2 arranged the world modulo 17 into a 16-notch “second-hand track” - the powers of the generator $g=3$ step in turn on all 16 nonzero remainders. Gauss’s stroke of genius was: do not try to solve head-on the degree-16 equation that $\zeta_{17}$ satisfies, but group the 16 roots along this track and sum each group, so that the groups satisfy a simple quadratic equation among themselves. This section makes the “first cut”: split the 16 roots into two groups of 8 each, and prove that the sums of these two groups are exactly the two roots of $x^2+x-4=0$ - and so $\sqrt{17}$ appears for the first time.

Additional notation for this section

3.1 Intuition: why “summing in groups” is a good idea

Facing $\zeta_{17}$ directly is hard - it satisfies a degree-16 equation. But the 16 roots, as a whole, have a great deal of symmetry (the cyclic structure of §2). Gauss’s idea is like cutting a cake: first cut the 16 roots into 2 pieces (each piece the sum of 8 roots, written $\eta_0,\eta_1$); these two pieces satisfy a quadratic equation, which is easy to solve; then cut each piece into 2 smaller pieces (the $\theta$ of §4), again a quadratic equation; cut 4 times like this, and each cut needs only the solution of a quadratic equation, the taking of one square root. 4 square roots drag $\zeta_{17}$ down from the sky to the ground that straightedge and compass can reach. This section is the first cut.

3.2 What a quadratic residue is (define first, then use)

A nonzero remainder $a$ is called a quadratic residue (QR) if it “is a square” modulo 17 - that is, there exists some $b$ with $b^2\equiv a\pmod{17}$. Otherwise it is called a quadratic non-residue (NQR).

Compute $1^2,2^2,\dots,8^2$ modulo 17 (beyond that they repeat symmetrically):

Removing duplicates gives 8 quadratic residues:

The connection with the generator of §2 (key): the quadratic residues are exactly the even powers of $g=3$. The reason is short: an even power $g^{2k}=(g^{k})^2$ is of course a square, so it is a QR; conversely, the “kernel” of the squaring map $x\mapsto x^2$ has only the two elements $\{\pm 1\}$ ($x^2\equiv 1$ only for $x\equiv\pm1$, since 17 is prime), so the squaring map is 2-to-1 - $16$ elements map onto $8$ images, and these 8 images are all the QRs, exactly the 8 even powers. So

The figure below draws this: the 16 remainders are placed on the unit circle, and the QRs (ochre) and NQRs (blue) are split into two groups by the parity of the power of $g=3$ - these are exactly the members of $\eta_0,\eta_1$, about to be defined.

3.3 The two first-level Gauss periods $\eta_0,\eta_1$

The 16 roots split into two first-level Gauss periods: 8 $\to\eta_0$ (orange), 8 $\to\eta_1$ (blue). — Animation: Abel (Manim)

Summing the roots of unity corresponding to the QRs, and those corresponding to the NQRs, gives two numbers:

Each is a sum of 8 roots of unity. Below we prove that they satisfy a beautiful quadratic equation.

3.4 Proposition one: $\eta_0+\eta_1=-1$

The two groups of exponents together are exactly $\{1,2,\dots,16\}$, so

And the sum of all 17 roots of unity is zero ($1+\zeta_{17}+\cdots+\zeta_{17}^{16}=0$, because they are the roots of $x^{17}-1=0$, whose $x^{16}$ coefficient is 0). Removing $\zeta_{17}^0=1$ gives $\sum_{k=1}^{16}\zeta_{17}^{k}=-1$. Hence

3.5 Proposition two: $\eta_0\cdot\eta_1=-4$ (with a complete account of the $8\times 8=64$ expansion)

The expansion of $\eta_0\cdot\eta_1$ into $8\times8=64$ terms: each nonzero remainder appears exactly 4 times, and the sum $=-4$. — Animation: Abel (Manim)

This is the only step in this section that takes some effort. By definition, multiplying two sums of 8 terms gives $8\times 8=64$ product terms, each of the form $\zeta_{17}^{a}\cdot\zeta_{17}^{b}=\zeta_{17}^{a+b}$:

Because $\zeta_{17}^{17}=1$, for each term only the exponent $c:=(a+b)\bmod 17$ matters. Classify the 64 terms by $c$, and write

We prove two things: (i) $N(0)=0$; (ii) for each $c\in\{1,\dots,16\}$, $N(c)=4$.

(i) $c=0$ is impossible. $a+b\equiv 0$ means $b\equiv -a$. Since $17\equiv 1\pmod 4$, $-1$ is a quadratic residue ($-1\equiv 16=4^2$). A residue times a residue is still a residue, so $-a=(-1)\cdot a$, when $a\in\mathrm{QR}$, is still in $\mathrm{QR}$, and never falls into $\mathrm{NQR}$. So no legitimate $(a,b)$ gives $c=0$, that is, $N(0)=0$.

(ii) Each nonzero $c$ exactly 4 times. Here we use a clean symmetry argument (not depending on $\eta_0\neq\eta_1$, to avoid circularity):

• Step one ($\mathrm{QR}$-shift): take any residue $t\in\mathrm{QR}$. Multiplying by $t$ sends $\mathrm{QR}\to\mathrm{QR}$ and $\mathrm{NQR}\to\mathrm{NQR}$ (residue times residue = residue, residue times non-residue = non-residue), so $(a,b)\mapsto(ta,tb)$ is a bijection of $\mathrm{QR}\times\mathrm{NQR}$ to itself, turning $a+b\equiv c$ into $\equiv tc$. Hence $N(c)=N(tc)$. Moreover, under the action of “multiplying by QR”, the nonzero remainders split into exactly two orbits - $\mathrm{QR}$ itself and $\mathrm{NQR}$. So $N$, on $\mathrm{QR}$, takes a constant value $N_{\mathrm R}$, and on $\mathrm{NQR}$ a constant value $N_{\mathrm N}$.
• Step two ($\mathrm{NQR}$-swap, welding the two constants into one): take any non-residue $s\in\mathrm{NQR}$. Multiplying by $s$ swaps $\mathrm{QR}\leftrightarrow\mathrm{NQR}$, so $(a,b)\mapsto(sb,sa)$ (note $sb\in\mathrm{QR}$, $sa\in\mathrm{NQR}$) is still a bijection of $\mathrm{QR}\times\mathrm{NQR}$ to itself, and $sa+sb\equiv sc$. So $N(c)=N(sc)$; and $s\in\mathrm{NQR}$ maps the $\mathrm{QR}$ class to the $\mathrm{NQR}$ class, and vice versa. This step gives $N_{\mathrm R}=N_{\mathrm N}$ directly - without needing any information about whether $\eta_0,\eta_1$ are equal.
• Step three (counting): $8N_{\mathrm R}+8N_{\mathrm N}=\sum_{c=1}^{16}N(c)=64-N(0)=64$, and combined with $N_{\mathrm R}=N_{\mathrm N}$ this gives $N_{\mathrm R}=N_{\mathrm N}=4$.

So each nonzero remainder appears exactly 4 times:

Why stress “not depending on $\eta_0\neq\eta_1$”: a common way of writing it uses the Galois automorphism $\sigma$ to derive $(N_{\mathrm R}-N_{\mathrm N})(\eta_0-\eta_1)=0$, and then divides by $\eta_0-\eta_1$. But that requires knowing first that $\eta_0\neq\eta_1$, and the cleanest reason for "$\eta_0\neq\eta_1$" comes precisely from $\sqrt{17}\neq 0$, which is about to be computed below - that would be

circular reasoning

. The NQR-swap argument above gets around this pit: it gives $N_{\mathrm R}=N_{\mathrm N}$ directly, without inverting cause and effect.

3.6 The first radical $\sqrt{17}$

$x^2+x-4=0 \Rightarrow \eta_{0,1}=\frac{-1\pm\sqrt{17}}{2}$ - $\sqrt{17}$ appears for the first time. — Abel (Manim)

By (1), (2) and Vieta’s theorem (the relation between roots and coefficients), $\eta_0,\eta_1$ are the two roots of

The discriminant is $1^2-4(1)(-4)=1+16=17$, so

$\sqrt{17}$ appears for the first time. $\eta_0,\eta_1$ are both real (complex conjugation sends $\zeta_{17}^a$ to $\zeta_{17}^{-a}$, and $-\mathrm{QR}=\mathrm{QR}$, $-\mathrm{NQR}=\mathrm{NQR}$, so the two sums are unchanged by conjugation). Take $\eta_0=\frac{-1+\sqrt{17}}{2}\approx 1.5616$ (the larger), $\eta_1=\frac{-1-\sqrt{17}}{2}\approx -2.5616$. It generates the first layer of the tower of fields, $K_1=\mathbb{Q}(\sqrt{17})$, $[K_1:\mathbb{Q}]=2$ - it can be constructed with a single square root, which is exactly what straightedge and compass can do.

3.7 Worked examples

Example 3.1 (checking the sum and product).

Numerically $\eta_0+\eta_1\approx 1.5616+(-2.5616)=-1$ ✓; $\eta_0\eta_1\approx 1.5616\times(-2.5616)=-4.000$ ✓.

Example 3.2 (spot check of $N(c)$).

Take $c=1$: count the pairs in $\mathrm{QR}\times\mathrm{NQR}$ with $a+b\equiv 1$ (requiring $a\in\mathrm{QR},b\in\mathrm{NQR}$): among the candidates, $(2,16)$ and $(9,9)$ are both out ($16,9\notin\mathrm{NQR}$);

the exactly $4$ pairs that are really legitimate are $(4,14),(8,10),(13,5),(15,3)$

(see the program enumeration below). Every nonzero $c$ gives 4, and $c=0$ gives 0.

# Verify (1),(2) and the count N(c) for eta_0 * eta_1.
QR  = {1, 2, 4, 8, 9, 13, 15, 16}     # = even powers of g=3 = squares mod 17
NQR = set(range(1, 17)) - QR          # = {3,5,6,7,10,11,12,14}
assert QR == {pow(b, 2, 17) for b in range(1, 17)}, "QR = squares mod 17"

from collections import Counter
N = Counter((a + b) % 17 for a in QR for b in NQR)
assert N[0] == 0,                       "c=0 never occurs (-1 is a QR mod 17)"
assert all(N[c] == 4 for c in range(1, 17)), "each nonzero residue exactly 4 times"
assert sum(N.values()) == 64

import cmath, math
z = cmath.exp(2j * math.pi / 17)
eta0 = sum(z**a for a in QR).real
eta1 = sum(z**b for b in NQR).real
assert abs(eta0 + eta1 - (-1)) < 1e-9          # (1)
assert abs(eta0 * eta1 - (-4)) < 1e-9          # (2)
assert abs(eta0 - (-1 + math.sqrt(17)) / 2) < 1e-9
print(f"eta0={eta0:.4f}, eta1={eta1:.4f}; sum=-1, prod=-4; sqrt(17) born  [OK]")

3.8 Modern significance

Gauss periods are not a one-off trick. Generalizing “grouping roots of unity by cosets of a subgroup and summing” gives the Gauss sums and period polynomials of modern number theory, which are:

• the core tool of the most concise proofs of quadratic reciprocity (the square of a Gauss sum gives $\pm p$, and the sign is exactly the sign in the reciprocity law);
• the computational skeleton of the class field theory of cyclotomic fields - the intermediate subfields generated by these periods correspond exactly to the subgroups of the Galois group (§4 will use this correspondence);
• the direct source of the cyclotomic periods in modern primality testing (e.g. the APR / APR-CL test, Adleman–Pomerance–Rumely 1983 + the practical Cohen–Lenstra variant) - APR is a primality test (it does no integer factorization), and its cyclotomic periods trace back to Jacobi sums.

A “summing in groups” done in order to draw a 17-gon grew into a common language of twentieth-century algebraic number theory.

— End of §3.

§4 — The group of symmetries: the Galois group, and the second and third cuts

§3 made the “first cut” - splitting the 16 roots into the two halves $\eta_0,\eta_1$, forcing out $\sqrt{17}$. But that cut relied on something not yet explained: why does “multiplying the exponent by some power of $g$” map quadratic residues neatly to quadratic residues, and non-residues to non-residues? This kind of operation, “swapping roots without making a mess”, is exactly the protagonist of this section - the Galois group. It is the invisible skeleton behind Gauss’s whole method of cutting. This section starts from zero (it does not assume you have heard words like “group theory” or “Galois”): first explain in plain words what “symmetry” actually means, then formalize it as a group, then use it to make the second cut cleanly and neatly ($\eta\to\theta$, forcing out $\sqrt{34-2\sqrt{17}}$), and make clear why each layer of the whole “tower of four quadratic extensions” has degree exactly 2.

Additional notation for this section