Engineering / Mathematics — Finite Fields
Subfield Structure and Uniqueness of Finite Fields
The subfield lattice of a finite field, its correspondence with divisors, and the uniqueness of each subfield.
Executive summary
The subfields of a field of order p to the k correspond exactly to the divisors of k, one for each divisor, and each is unique.
This is the tower law applied to degrees, and it is what makes distinct degree factorisation work.
Learning objectives
- State the subfield correspondence.
- Prove uniqueness of each subfield.
- Apply the correspondence to factorisation.
01The correspondence
Subfield structure
F_{p^k} contains exactly one subfield of order p^d for each divisor d of k, and no other subfields.
Necessity is the tower law: a subfield of order p^d makes F_{p^k} a vector space over it, so d must divide k.
Sufficiency and uniqueness follow from the root characterisation. The elements satisfying a^{p^d} = a form a subfield, and there are exactly p^d of them since the polynomial X^{p^d} − X is squarefree and divides X^{p^k} − X when d divides k.
F_{p^d} = {a ∈ F_{p^k} : a^{p^d} = a} for d | k02The lattice
The subfield lattice is isomorphic to the divisor lattice of k, ordered by divisibility.
| Field | Subfields | Lattice shape |
|---|---|---|
| F_{p^6} | F_p, F_{p²}, F_{p³}, F_{p^6} | Divisors of 6 |
| F_{p^4} | F_p, F_{p²}, F_{p^4} | A chain |
| F_{p^k}, k prime | F_p and itself only | Two elements |
| F_{p^{12}} | One per divisor of 12 | Six subfields |
03Application to factorisation
Roots and degrees
An element of F_{p^k} lies in F_{p^d} exactly when its minimal polynomial over F_p has degree dividing d.
Consequently X^{p^d} − X is the product of all monic irreducible polynomials over F_p whose degree divides d.
This identity is the engine of distinct degree factorisation. Taking the gcd of a polynomial with X^{p^d} − X extracts exactly the factors of degree dividing d, so sweeping d upwards separates the factors by degree.
Compute X^{p^d} mod f
By repeated Frobenius application, which is cheaper than general exponentiation.
Take the gcd with f
This is the product of all irreducible factors of f whose degree divides d.
Divide out
Remove the extracted part and increment d.
Repeat
Until the remaining polynomial is constant or d exceeds half the degree.
The correspondence between subfields and divisors is therefore not merely structural bookkeeping — it is what makes a whole class of factorisation algorithms possible.
04Frequently asked questions
Why is each subfield unique?
Because it is characterised as the solution set of X^{p^d} = X, which is determined by the equation rather than by a choice. Two subfields of the same order would both equal that solution set.
Does the same hold for infinite fields?
No. The rationals have no proper subfields, but larger fields can have wildly complicated subfield lattices with no divisor correspondence. The clean structure is special to finite fields.
Why avoid small characteristic in cryptography?
Because quasi-polynomial discrete logarithm algorithms exploit the rich subfield structure in small characteristic. Those fields are effectively broken for discrete-log-based cryptography.
Sources and method
Structural reference: Victor Shoup, A Computational Introduction to Number Theory and Algebra, Version 1, Cambridge University Press, 2005 — book pages 454-456.
This page carries the durable method layer only: definitions, constructions, algorithms, complexity results and selection criteria, authored originally for KEVOS. No text is transcribed or paraphrased from the source, and no numeric tables or benchmark data are reproduced — these are routed to live authoritative sources instead.
Author: Kevin Jogin. Last reviewed 2026-08-07.