Hilbert’s theorem 90 is the 90’th theorem in Hilbert’s Zahlbericht (meaning number report according to google translate), which is a famous report on the state of algebraic number theory at the end of the nineteenth century. It is a basic theorem shedding some light on cyclic field extensions (a Galois extension with a cyclic Galois group) and it seems to lead to some really big ideas in algebraic number theory. As a corollary of this, we directly get a parametrization of the rational points on the circle, hence of integral pythagorean triples.

Given a finite extension $k \hookrightarrow F$, we can naturally consider $F$ as a $k$-vector space. We can use this point of view to define a notion of norm in field extensions. For any $\alpha \in F$, we define the norm of $\alpha$ with respect to this extension as

$N_{F/k}(\alpha) = \det(m_{\alpha})$

where $m_{\alpha}$ is multiplication by $\alpha$ viewed as a $k$-linear transformation on $F$. It also makes sense to speak of the trace of an element with respect to a field extension and we actually get an analogous “additive” Hilbert 90 without further difficulty.

Take for example the complex numbers as an extension of the reals. If $z = a + bi \in \mathbf{C}$, then in the basis $(1, i)$ the application $m_z$ is represented by the matrix $\bigl( \begin{smallmatrix} a&-b \\ b & a \end{smallmatrix} \bigr)$ so we get $N_{\mathbf{C}/\mathbf{R}}(z) = a^2 + b^2$. A similar argument shows that in a quadratic number field of the form $\mathbf{Q}(\sqrt{-d})$ for $d$ an integer which is not a square, we find $N_{\mathbf{Q}(\sqrt{-d})/\mathbf{Q}}(a+b \sqrt{-d}) = a^2 + b^2d$.

Lemma: For a simple algebraic extension $k \hookrightarrow k(\alpha)$, we have $N_{k(\alpha)/k}(\alpha) = (-1)^da_0$ where $a_0$ is the constant term of the minimal polynomial of $\alpha$ in $k$.

Proof: Let $f_{\alpha}$ be the minimal polynomial of $\alpha$, say of degree $d$ and recall that $k(\alpha) \cong k[x]/(f_{\alpha})$ can be seen as the field of $k$-polynomials of degree less than $d$ where multiplication is done modulo $(f_{\alpha})$. Then $\alpha$ is identified with the class of $x$. A nice basis for this space is $(1, x, x^2, \ldots, x^{d-1})$. Here multiplication by $\alpha$ acts on these vectors as $1 \mapsto x, x \mapsto x^2, \ldots x^{d-1} \mapsto x^d$ (everything modulo $(f_{\alpha})$). But $x^d = -a_0 - a_1x - a_2x^2 - \cdots - a_{d-1}x^{d-1} \mod (f_{\alpha})$ so multiplication by $\alpha$ is represented by

$\left( \begin{smallmatrix} 0 & 0 & \cdots & 0 & -a_0 \\ 1 & 0 & \cdots & 0 & -a_1 \\ && \ddots && \\ 0 & 0 & \cdots & 1 & -a_{d-1} \end{smallmatrix} \right)$.

This matrix clearly has determinant $(-1)^da_0$ hence the assertion.

QED

Note that it also follows from the proof that $\text{tr}_{k(\alpha)/k}(\alpha) = -a_{d-1}$. To get a better description of that norm, we need another lemma:

Lemma: For $k \hookrightarrow F$ a finite extension and $\alpha \in F$, let $[F : k(\alpha)] = r$. Then $N_{F/k}(\alpha) = (N_{k(\alpha)/k} (\alpha))^r$.

Proof: If $(e_1, \ldots, e_r)$ is a basis of $F$ as a vector space over $k(\alpha)$ and $(1, x, x^2, \ldots, x^{d-1})$ is the canonical basis of $k(\alpha)$ over $k$, then $(e_ix^j)$ for $i=1, \ldots, r$ and $j=1, \ldots, d-1$ is a basis for $F$ over $k$. Ordering this basis by $(e_1x^1, e_1x^2, \ldots, e_1x^{d-1}, e_2x^1, \ldots, e_2x^{d-1}, \ldots, e_rx^1, \ldots, e_rx^{d-1})$, the matrix of multiplication by $\alpha$ is given by the block diagonal matrix

$\left(\begin{smallmatrix} A &&& \\ &A&& \\ & & \ddots & \\ &&&A \end{smallmatrix} \right)$

where $A$ is the matrix representing multiplication by $\alpha$ in $k(\alpha)$ as in the first lemma.

QED

The analogous result for the trace is that $\text{tr}_{F/k} (\alpha) = r(\text{tr}_{k(\alpha)/k}(\alpha))$. These two lemmas let us interpret the norm and trace in a clarifying way:

Proposition: For $k \hookrightarrow F$ a Galois extension and $\alpha \in F$, we have

$N_{F/k}(\alpha) = \displaystyle\prod_{\sigma \in Gal(F/k)} \sigma (\alpha)$     and      $\text{tr}_{F/k}(\alpha) = \displaystyle\sum_{\sigma \in Gal(F/k)} \sigma (\alpha)$.

Proof: If $\lambda_1, \ldots, \lambda_d$ are the roots of the minimal polynomial $f_{\alpha}(x)$  of $\alpha$ whose constant term we denote by $a_0$ and $F$ is of degree $r$ over $k(\alpha)$, then since $(-1)^da_0 = \prod_{i=1}^r \lambda_i$, the preceding lemmas tell us that

$N_{F/k}(\alpha) = \left(\displaystyle\prod_{i=1}^d \lambda_i \right) ^r$.

Now, recall that $Gal(F/k)$ acts transitively on the set of roots of $f_{\alpha}(x)$ since it is irreducible. Denoting by $\text{Stab}(\lambda)$ the stabilizer of a root $\lambda$ for this action, we have $\text{Stab}(\lambda) = Gal(F/k(\lambda))$ and since there is only one orbit, all stabilizers are conjugate of each others so $|Gal(F/k(\lambda))| = |Gal(F/k(\alpha))| = r$ for all root $\lambda$. This shows that to each root of $f_{\alpha}(x)$ there corresponds at least $r$ elements of $Gal(F/k)$. Since $|Gal(F/k)| = rd$, this correspondence is bijective and we have

$\displaystyle\prod_{\sigma \in Gal(F/k)} \sigma (\alpha) = \left( \displaystyle\prod_{i=1}^d \lambda_i \right)^r = N_{F/k}(\alpha)$

as we wanted.

QED

We are now in a position to state and prove our main theorem, which characterizes unit norm elements in a cyclic extension:

Theorem (Hilbert 90): Let $k \hookrightarrow F$ be a cyclic (Galois) extension of degree $n$, take $\sigma$ a generator for the Galois group and $\alpha \in F$. Then $N_{F/k}(\alpha) = 1$ if and only if $\alpha = b/\sigma(b)$ for some $b \in F$.

One direction is immediate. Indeed, for any $\beta \in F$ and $\sigma \in Gal(F/k)$, we have

$N_{F/k}(\beta/\sigma(\beta)) = \prod (\tau(\beta)/\tau \circ \sigma (\beta)) = \prod \tau(\beta) / \prod \tau'(\beta) = 1$

(where the products are all taken over $Gal(F/k)$). For the other direction, we need a lemma:

Lemma: If $\varphi_1, \ldots, \varphi_m$ are pairwise distinct $k$-automorphisms of $F$, then they are linearly independant over $F$.

Proof of the lemma: Let $\varphi = \sum_{j=1}^rc_j \varphi_{i_j} = 0$ be a minimal linear relation among the automorphisms. Since they are pairwise distinct, there exists $\lambda \in F$ such that $\varphi_{i_1}(\alpha) \neq \varphi_{i_2}(\alpha)$. Then for all $x \in F$, since $\varphi(x) = 0$, we have also that $\varphi(\lambda x) = 0$. We obtain in this way that for all $x \in F$,

$0 = \varphi(\lambda x) = \displaystyle\sum_{j=1}^r c_j\varphi_{i_j}(\lambda) \varphi_{i_j}(x)$

and

$0 = \varphi_{i_1}(\lambda)\varphi(x) = \displaystyle\sum_{j=1}^rc_j \varphi_{i_1}(\lambda)\varphi_{i_j}(x)$

so subtracting give us $0 = \sum_{j=2}^rc_j(\varphi_{i_j}(\lambda) - \varphi_{i_1}(\lambda)) \varphi_{i_j}(x)$ which is a non-trivial relation (since we took $\lambda$ so that $\varphi_{i_2}(\lambda) \neq \varphi_{i_1}(\lambda)$). But this relation is shorter than our initial relation, which we supposed to be minimal. This is a contradiction and the lemma is proven.

Proof of the theorem: Suppose $N_{F/k}(\alpha) = 1$ and define $\tau : F \to F$ as $\tau(b) = \alpha \sigma (b)$. Then it suffices to find a fixed point of $\tau$. It is easy to see that for $k \in \{1, \ldots, n\}$, we have

$\tau^k(b) = \alpha \sigma(\alpha)\sigma^2(\alpha) \cdots \sigma^{k-1}\sigma^k(b)$.

In particular, $\tau^n(b) = \prod_{i=1}^n\sigma^n(\alpha)\sigma^n(b) = N_{F/k}(\alpha)b$ so if $N_{F/k}(\alpha) = 1$, we have $\tau^n(b) = b$ for all $b \in F$. In particular, the order of $\tau$ is $n$. Since moreover $\tau$ is $k$-linear over $F$, we get a representation $\rho : \mathbf{Z}/n\mathbf{Z} \to GL(F)$ by $\rho(m) = \tau^m$. From this point of view, it is easy to determine if $\tau$ has a fixed point. Indeed, for any group $G$ and any representation $\phi : G \to GL(V)$, recall that

$p := \dfrac1{|G|} \displaystyle\sum_{g \in G} \phi(g)$

is the projection of $V$ onto the trivial summand of the representation. So to show that a group action has a fixed point, it suffices to show that this map is not identically $0$. But in our case we have

\begin{aligned} p &= \frac1n(1_F + \tau + \tau^2 + \cdots + \tau^{n-1}) \\ &= \frac1n(1_F + \alpha \sigma+ \alpha \sigma(\alpha)\sigma^2 + \cdots + \alpha \sigma(\alpha)\cdots \sigma^{n-2}(\alpha)\sigma^{n-1}) \end{aligned}

and since $\sigma$ is a generator for the Galois group, the automorphisms $1_F, \sigma, \sigma^2, \ldots, \sigma^{n-1}$ are linearly independent by the lemma so $p$ is not identically zero because that would give us a non-trivial linear relation between them. This shows that $\tau(b) = b$ for some $b \in F$ and that $\alpha = b/\sigma(b)$.

QED

Note that the analogous result for the trace is that in a cyclic extension, $Tr(\alpha) = 0$ is and only if $\alpha = \beta - \sigma(\beta)$. As a cool application of this theorem, we can give a parametrization of pythagorean triples. Indeed, consider the equation $x^2 + dy^2 = 1$ for $d$ not a square. Recall that the norm of $\alpha = a + b\sqrt{-d} \in \mathbf{Q}(\sqrt{-d})$ is

$N_{\mathbf{Q}(\sqrt{-d})/\mathbf {Q}}(\alpha) = a^2 + db^2$

(this is easy to see with the finer interpretation of the norm as a product over the Galois group). So rational solutions of our equation correspond exactly to the elements of unit norm in $\mathbf{Q}(\sqrt{-d})$. By Hilbert’s theorem 90 and since conjugation generates the Galois group, these elements are those of the form

$\alpha = \dfrac{a+b\sqrt{-d}}{a-b\sqrt {-d}} = \dfrac{a^2 - db^2}{a^2 + b^2} + \dfrac{2ab}{a^2 + b^2}\sqrt{-d}$.

Since multiplying $a$ and $b$ by some rational number does not change the expression, we can take $a$ and $b$ as integers. Therefore, the rational solutions to the equation are

$(x,y) = \left(\dfrac{a^2 - db^2}{a^2 + b^2}, \dfrac{2ab}{a^2 + b^2}\right)$

where $(a,b) \in \mathbf{N}^2$. Letting $d=1$, we find all the rational points on the unit circle, which give us the integer pythagorean triples by the correspondence $(a/c, b/c) \mapsto (a,b,c)$.