\documentclass[numbers=enddot,12pt,final,onecolumn,notitlepage]{scrartcl}%
\usepackage[headsepline,footsepline,manualmark]{scrlayer-scrpage}
\usepackage[all,cmtip]{xy}
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{framed}
\usepackage{comment}
\usepackage{color}
\usepackage[breaklinks=True]{hyperref}
\usepackage[sc]{mathpazo}
\usepackage[T1]{fontenc}
\usepackage{needspace}
\usepackage{tabls}
\usepackage{tikz}
\usepackage{bbding}
%TCIDATA{OutputFilter=latex2.dll}
%TCIDATA{Version=5.50.0.2960}
%TCIDATA{LastRevised=Thursday, August 17, 2023 02:21:34}
%TCIDATA{SuppressPackageManagement}
%TCIDATA{<META NAME="GraphicsSave" CONTENT="32">}
%TCIDATA{<META NAME="SaveForMode" CONTENT="1">}
%TCIDATA{BibliographyScheme=Manual}
%TCIDATA{Language=American English}
%BeginMSIPreambleData
\providecommand{\U}[1]{\protect\rule{.1in}{.1in}}
%EndMSIPreambleData
\usetikzlibrary{arrows.meta}
\usetikzlibrary{chains}
\usetikzlibrary{shapes}
\usetikzlibrary{decorations.pathmorphing}
\usetikzlibrary{calc}
\newcounter{exer}
\newcounter{exera}
\theoremstyle{definition}
\newtheorem{theo}{Theorem}[subsection]
\newenvironment{theorem}[1][]
{\begin{theo}[#1]\begin{leftbar}}
{\end{leftbar}\end{theo}}
\newtheorem{lem}[theo]{Lemma}
\newenvironment{lemma}[1][]
{\begin{lem}[#1]\begin{leftbar}}
{\end{leftbar}\end{lem}}
\newtheorem{prop}[theo]{Proposition}
\newenvironment{proposition}[1][]
{\begin{prop}[#1]\begin{leftbar}}
{\end{leftbar}\end{prop}}
\newtheorem{defi}[theo]{Definition}
\newenvironment{definition}[1][]
{\begin{defi}[#1]\begin{leftbar}}
{\end{leftbar}\end{defi}}
\newtheorem{remk}[theo]{Remark}
\newenvironment{remark}[1][]
{\begin{remk}[#1]\begin{leftbar}}
{\end{leftbar}\end{remk}}
\newtheorem{coro}[theo]{Corollary}
\newenvironment{corollary}[1][]
{\begin{coro}[#1]\begin{leftbar}}
{\end{leftbar}\end{coro}}
\newtheorem{conv}[theo]{Convention}
\newenvironment{convention}[1][]
{\begin{conv}[#1]\begin{leftbar}}
{\end{leftbar}\end{conv}}
\newtheorem{quest}[theo]{Question}
\newenvironment{question}[1][]
{\begin{quest}[#1]\begin{leftbar}}
{\end{leftbar}\end{quest}}
\newtheorem{warn}[theo]{Warning}
\newenvironment{warning}[1][]
{\begin{warn}[#1]\begin{leftbar}}
{\end{leftbar}\end{warn}}
\newtheorem{conj}[theo]{Conjecture}
\newenvironment{conjecture}[1][]
{\begin{conj}[#1]\begin{leftbar}}
{\end{leftbar}\end{conj}}
\newtheorem{exam}[theo]{Example}
\newenvironment{example}[1][]
{\begin{exam}[#1]\begin{leftbar}}
{\end{leftbar}\end{exam}}
\newtheorem{exmp}[exer]{Exercise}
\newenvironment{exercise}[1][]
{\begin{exmp}[#1]\begin{leftbar}}
{\end{leftbar}\end{exmp}}
\newenvironment{statement}{\begin{quote}}{\end{quote}}
\newenvironment{fineprint}{\begin{small}}{\end{small}}
\iffalse
\newenvironment{proof}[1][Proof]{\noindent\textbf{#1.} }{\ \rule{0.5em}{0.5em}}
\newenvironment{convention}[1][Convention]{\noindent\textbf{#1.} }{\ \rule{0.5em}{0.5em}}
\newenvironment{question}[1][Question]{\noindent\textbf{#1.} }{\ \rule{0.5em}{0.5em}}
\fi
\let\sumnonlimits\sum
\let\prodnonlimits\prod
\let\cupnonlimits\bigcup
\let\capnonlimits\bigcap
\renewcommand{\sum}{\sumnonlimits\limits}
\renewcommand{\prod}{\prodnonlimits\limits}
\renewcommand{\bigcup}{\cupnonlimits\limits}
\renewcommand{\bigcap}{\capnonlimits\limits}
\newcommand\arxiv[1]{\href{http://www.arxiv.org/abs/#1}{\texttt{arXiv:#1}}}
\setlength\tablinesep{3pt}
\setlength\arraylinesep{3pt}
\setlength\extrarulesep{3pt}
\setlength\textheight{22.5cm}
\setlength\textwidth{14.8cm}
\newenvironment{verlong}{}{}
\newenvironment{vershort}{}{}
\newenvironment{noncompile}{}{}
\excludecomment{verlong}
\includecomment{vershort}
\excludecomment{noncompile}
\newcommand{\defn}[1]{{\color{darkred}\emph{#1}}}
\newcommand{\CC}{\mathbb{C}}
\newcommand{\RR}{\mathbb{R}}
\newcommand{\QQ}{\mathbb{Q}}
\newcommand{\NN}{\mathbb{N}}
\newcommand{\ZZ}{\mathbb{Z}}
\newcommand{\KK}{\mathbb{K}}
\newcommand{\set}[1]{\left\{ #1 \right\}}
\newcommand{\abs}[1]{\left| #1 \right|}
\newcommand{\tup}[1]{\left( #1 \right)}
\newcommand{\ive}[1]{\left[ #1 \right]}
\newcommand{\floor}[1]{\left\lfloor #1 \right\rfloor}
\newcommand{\arinj}{\ar@{_{(}->}}
\newcommand{\arinjrev}{\ar@{^{(}->}}
\newcommand{\arsurj}{\ar@{->>}}
\newcommand{\arelem}{\ar@{|->}}
\newcommand{\arback}{\ar@{<-}}
\newcommand{\are}{\ar@{-}}
\newcommand{\arebi}[1][]{\ar@{<-}@/_/[#1] \ar@/^/[#1]}
\newcommand{\of}{\text{ of }}
\definecolor{darkgreen}{rgb}{0,.5,0}
\newtheoremstyle{plainsl}
{8pt plus 2pt minus 4pt}
{8pt plus 2pt minus 4pt}
{\slshape}
{0pt}
{\bfseries}
{.}
{5pt plus 1pt minus 1pt}
{}
\theoremstyle{plainsl}
\ihead{Lecture 26, version \today}
\ohead{page \thepage}
\cfoot{}
\begin{document}
\section*{Math 332 Winter 2023, Lecture 26: Polynomials}

\textbf{website:}
\texttt{\href{https://www.cip.ifi.lmu.de/~grinberg/t/23wa}{\texttt{https://www.cip.ifi.lmu.de/\symbol{126}%
grinberg/t/23wa}}}

\setcounter{section}{2}

\section{Monoid algebras and polynomials}

Recall: For this entire chapter, we fix a \textbf{commutative} ring $R$.

\setcounter{subsection}{2}

\subsection{Univariate polynomials (cont'd)}

\setcounter{subsubsection}{2}

\setcounter{theo}{9}

\subsubsection{Roots}

We shall now discuss roots of polynomials. Our definition of roots is rather liberal:

\begin{definition}
Let $A$ be an $R$-algebra. Let $f\in R\left[  x\right]  $ be a polynomial. An
element $a\in A$ is called a \textbf{root} of $f$ if $f\left(  a\right)  =0$
(that is, $f\left[  a\right]  =0$).
\end{definition}

This allows, e.g., a matrix or an element of a quotient ring to be a root of a
polynomial. For example, the matrix $\left(
\begin{array}
[c]{cc}%
0 & 1\\
1 & 0
\end{array}
\right)  \in\mathbb{Q}^{2\times2}$ is a root of the polynomial $x^{2}%
-1\in\mathbb{Q}\left[  x\right]  $, since
\[
\left(  x^{2}-1\right)  \left[  \left(
\begin{array}
[c]{cc}%
0 & 1\\
1 & 0
\end{array}
\right)  \right]  =\left(
\begin{array}
[c]{cc}%
0 & 1\\
1 & 0
\end{array}
\right)  ^{2}-\underbrace{\left(
\begin{array}
[c]{cc}%
1 & 0\\
0 & 1
\end{array}
\right)  }_{\substack{\text{this is the unity}\\\text{of the ring }%
\mathbb{Q}^{2\times2}}}=\left(
\begin{array}
[c]{cc}%
0 & 0\\
0 & 0
\end{array}
\right)  =0_{\mathbb{Q}^{2\times2}}.
\]
For another example, the polynomial $x^{2}+1\in\mathbb{Z}\left[  x\right]  $
has infinitely many roots in the ring $\mathbb{H}$ of quaternions. (Indeed, it
is not hard to check that $\left(  ai+bj+ck\right)  ^{2}=-\left(  a^{2}%
+b^{2}+c^{2}\right)  $ in $\mathbb{H}$ for any $a,b,c\in\mathbb{R}$. But there
are infinitely many triples $\left(  a,b,c\right)  \in\mathbb{R}^{3}$
satisfying $a^{2}+b^{2}+c^{2}=1$.)

Let us first say a few things about roots in $R$:

\begin{proposition}
Let $f$ be a polynomial in $R\left[  x\right]  $. Let $a\in R$. Then, $a$ is a
root of $f$ if and only if $x-a\mid f$ in $R\left[  x\right]  $.
\end{proposition}

\begin{proof}
See \S 4.3.3 in the text.
\end{proof}

The following theorem is often known as the \textbf{easy half of the FTA
(Fundamental Theorem of Algebra)}:

\begin{theorem}
[easy half of the FTA]\label{thm.polring.univar-easyFTA}Let $R$ be an integral
domain. Let $n\in\mathbb{N}$. Then, any nonzero polynomial $f\in R\left[
x\right]  $ of degree $\leq n$ has at most $n$ roots in $R$. (We are not
counting the roots with multiplicity here.)
\end{theorem}

\begin{proof}
See \S 4.3.3 in the text.
\end{proof}

Theorem \ref{thm.polring.univar-easyFTA} can fail if $R$ is not an integral
domain. For example, the polynomial $x^{2}-\overline{1}$ has $4$ roots in
$\mathbb{Z}/8$. (Find them!)

\begin{remark}
The famous \textbf{fundamental theorem of algebra} (short: \textbf{FTA}) says
that any polynomial of degree $n$ in $\mathbb{C}\left[  x\right]  $ has
exactly $n$ roots in $\mathbb{C}$, if we count the roots with multiplicity.
Despite its name, this theorem is not actually a theorem of algebra, as it
relies on the analytic structure of the complex numbers (and the underlying
real numbers), and does not hold (e.g.) for the Gaussian rationals
$\mathbb{Q}\left[  i\right]  $. Accordingly, each proof of the FTA requires at
least a little bit of real analysis (and sometimes a not-so-little bit).
Various proofs can be found in \cite[Chapter 3]{LaNaSc16}, \cite[Theorem
7.1]{Aluffi16}, \cite[Chapter IX, \S 10]{Knapp1}, \cite[Theorem 44.8]%
{Warner90}, \cite[Theorem 11.6.7]{Steinb06} and many other places (some of
which prove weaker-sounding but equivalent versions of the result); more
exotic proofs are listed in \url{https://mathoverflow.net/questions/10535} .

However, one \textquotedblleft half\textquotedblright\ of the FTA -- namely,
the claim that a polynomial of degree $n$ in $\mathbb{C}\left[  x\right]  $
always has \textbf{at most} $n$ roots in $\mathbb{C}$ -- actually can be
proved algebraically, and holds not just for $\mathbb{C}$ but also for any
integral domain $R$ in its stead. If we drop the notion of multiplicities,
then this \textquotedblleft half\textquotedblright\ is precisely Theorem
\ref{thm.polring.univar-easyFTA}. Thus, Theorem
\ref{thm.polring.univar-easyFTA} is called the \textquotedblleft easy half of
the FTA\textquotedblright.

As far as abstract algebra is concerned, this easy half is by far the most
useful; the next subsections will attest to some of its uses. In comparison,
the \textquotedblleft hard half of the FTA\textquotedblright\ (the part that
really requires $\mathbb{C}$) is rarely used in abstract algebra (since
algebraists prefer to work in settings more general than $\mathbb{C}$), but it
is important (e.g.) in complex linear algebra, where it is responsible (e.g.)
for the fact that each $n\times n$-matrix over $\mathbb{C}$ has $n$
eigenvalues (counted with multiplicities). Thus, the name \textquotedblleft
FTA\textquotedblright\ should be regarded as somewhat of a historical artefact.
\end{remark}

\subsubsection{Application to $\mathbb{Z}/p$: Wilson revisited}

The easy half of the FTA has a surprising number of applications, some fairly
unexpected. We begin with one of the simplest.

Let $p$ be a prime number. Consider the polynomial%
\[
x^{p}-x\in\left(  \mathbb{Z}/p\right)  \left[  x\right]  .
\]
This polynomial has degree $p$, and has $p$ roots in $\mathbb{Z}/p$: Indeed,
any element $a\in\mathbb{Z}/p$ satisfies $a^{p}=a$ (by Fermat's Little
Theorem\footnote{Proposition 2.6.4 in the text}) and thus is a root of the
polynomial $x^{p}-x$. No surprises here; just one example of Theorem
\ref{thm.polring.univar-easyFTA} being right.

However, we can do something more interesting. Namely, consider the more
sophisticated polynomial%
\begin{align*}
f:=  &  \left(  x^{p}-x\right)  -\underbrace{\prod_{u\in\mathbb{Z}/p}\left(
x-u\right)  }_{=\left(  x-\overline{0}\right)  \left(  x-\overline{1}\right)
\cdots\left(  x-\overline{p-1}\right)  }\\
=  &  \left(  x^{p}-x\right)  -\left(  x-\overline{0}\right)  \left(
x-\overline{1}\right)  \cdots\left(  x-\overline{p-1}\right)  \in\left(
\mathbb{Z}/p\right)  \left[  x\right]  .
\end{align*}
This polynomial $f$ again has $p$ roots in $\mathbb{Z}/p$ (since every
$a\in\mathbb{Z}/p$ satisfies\footnote{We are tacitly using Theorem 3.2.7 from
Lecture 25 here. Indeed, thanks to this theorem, we know that substituting $a$
for $x$ in the product $\left(  x-\overline{0}\right)  \left(  x-\overline
{1}\right)  \cdots\left(  x-\overline{p-1}\right)  $ yields the product
$\left(  a-\overline{0}\right)  \left(  a-\overline{1}\right)  \cdots\left(
a-\overline{p-1}\right)  $.}%
\[
f\left[  a\right]  =\underbrace{\left(  a^{p}-a\right)  }%
_{\substack{=0\\\text{(by Fermat's Little}\\\text{Theorem)}}%
}-\underbrace{\left(  a-\overline{0}\right)  \left(  a-\overline{1}\right)
\cdots\left(  a-\overline{p-1}\right)  }_{\substack{=0\\\text{(since
}a-a\text{ is a factor of this product)}}}=0-0=0,
\]
thus is a root of $f$), but its degree is $\leq p-1$ (since the polynomials
$x^{p}-x$ and $\prod_{u\in\mathbb{Z}/p}\left(  x-u\right)  $ both have leading
term $x^{p}$, and thus their leading terms cancel out when you take the
difference). This contradicts the easy half of the FTA, unless $f$ is zero. So
$f$ must be $0$. In other words,%
\[
x^{p}-x=\prod_{u\in\mathbb{Z}/p}\left(  x-u\right)  .
\]
So we have proved the following:

\begin{proposition}
\label{prop.ent.xp-x-over-Fp}Let $p$ be a prime number. Then,%
\[
x^{p}-x=\prod_{u\in\mathbb{Z}/p}\left(  x-u\right)
\ \ \ \ \ \ \ \ \ \ \text{in the polynomial ring }\left(  \mathbb{Z}/p\right)
\left[  x\right]  .
\]

\end{proposition}

We can derive more concrete conclusions from this equality by comparing
coefficients. For example, comparing the coefficients of $x^{p-1}$ on both
sides, we obtain (for $p>2$) that%
\[
0=-\left(  \overline{0}+\overline{1}+\cdots+\overline{p-1}\right)
\]
(since the coefficient of $x^{p-1}$ in $x^{p}-x$ is $0$ when $p>2$, whereas
the coefficient of $x^{p-1}$ in $\prod_{u\in\mathbb{Z}/p}\left(  x-u\right)  $
is $-\left(  \overline{0}+\overline{1}+\cdots+\overline{p-1}\right)  $ because
of the way how $x^{p-1}$ terms are generated when the product $\prod
_{u\in\mathbb{Z}/p}\left(  x-u\right)  $ is expanded). This can be rewritten
as%
\[
\overline{0}+\overline{1}+\cdots+\overline{p-1}=0,
\]
i.e., as%
\[
0+1+\cdots+\left(  p-1\right)  \equiv0\operatorname{mod}p.
\]
This is a nice congruence, although it can be easily proved directly as well
(since $0+1+\cdots+\left(  p-1\right)  =\dfrac{\left(  p-1\right)  p}%
{2}=\underbrace{\dfrac{p-1}{2}}_{\substack{\in\mathbb{Z}\\\text{when }%
p>2}}\cdot \,p\equiv0\operatorname{mod}p$ for $p>2$). But comparing other
coefficients results in less obvious consequences. If two polynomials $f$ and
$g$ are equal, then each monomial has equal coefficients in them (i.e., each
$n\in\mathbb{N}$ satisfies $\left[  x^{n}\right]  f=\left[  x^{n}\right]  g$),
and thus a single equality between two polynomials gives rise to an infinite
sequence of equalities between coefficients (although only finitely many of
them are nontrivial).

There is also another way to obtain consequences from Proposition
\ref{prop.ent.xp-x-over-Fp}: Namely, we can rewrite the claim of Proposition
\ref{prop.ent.xp-x-over-Fp} as follows:%
\begin{align*}
x^{p}-x  &  =\prod\limits_{u\in\mathbb{Z}/p}\left(  x-u\right)
=\underbrace{\left(  x-\overline{0}\right)  }_{=x}\left(  x-\overline
{1}\right)  \cdots\left(  x-\overline{p-1}\right) \\
&  =x\left(  x-\overline{1}\right)  \left(  x-\overline{2}\right)
\cdots\left(  x-\overline{p-1}\right)  .
\end{align*}
Dividing both sides of this equality by $x$ (with remainder if you will, but
the remainder will be $0$), we obtain%
\[
x^{p-1}-\overline{1}=\left(  x-\overline{1}\right)  \left(  x-\overline
{2}\right)  \cdots\left(  x-\overline{p-1}\right)  .
\]
Now, substituting $\overline{0}$ for $x$ in this equality, we obtain%
\begin{align*}
\overline{0}^{p-1}-\overline{1}  &  =\left(  \overline{0}-\overline{1}\right)
\left(  \overline{0}-\overline{2}\right)  \cdots\left(  \overline{0}%
-\overline{p-1}\right)  =\left(  -\overline{1}\right)  \left(  -\overline
{2}\right)  \cdots\left(  -\overline{p-1}\right) \\
&  =\left(  -1\right)  ^{p-1}\overline{1\cdot2\cdot\cdots\cdot\left(
p-1\right)  }=\left(  -1\right)  ^{p-1}\overline{\left(  p-1\right)  !}.
\end{align*}
Thus,%
\[
\left(  -1\right)  ^{p-1}\overline{\left(  p-1\right)  !}%
=\underbrace{\overline{0}^{p-1}}_{\substack{=\overline{0}\\\text{(since
}p>1\text{)}}}-\,\overline{1}=\overline{-1}.
\]
Therefore,
\[
\overline{\left(  p-1\right)  !}=\left(  -1\right)  ^{p-1}\cdot\overline
{-1}=\overline{\left(  -1\right)  ^{p}}\ \ \ \ \ \ \ \ \ \ \text{in
}\mathbb{Z}/p.
\]
Back in $\mathbb{Z}$, this means that%
\[
\left(  p-1\right)  !\equiv\left(  -1\right)  ^{p}\operatorname{mod}p.
\]
Since it is easy to see that $\left(  -1\right)  ^{p}\equiv
-1\operatorname{mod}p$ (by Fermat's Little Theorem, or by separating the cases
of $p$ even and $p$ odd), we can simplify this to%
\[
\left(  p-1\right)  !\equiv-1\operatorname{mod}p.
\]
This is exactly Wilson's theorem that we proved a while ago (Theorem 1.15.2 in
Lecture 17). Thus, we have found a new proof of Wilson's theorem.

\bigskip

Here is yet another unexpected application of the easy half of the FTA:

\begin{proposition}
Let $p$ be a prime. Let $k\in\left\{  0,1,\ldots,p-2\right\}  $. Then, the sum%
\[
0^{k}+1^{k}+\cdots+\left(  p-1\right)  ^{k}=\sum_{j=0}^{p-1}j^{k}%
\]
is divisible by $p$.
\end{proposition}

\begin{proof}
There is a beautiful proof of this, but the lecture is too short. See
Proposition 4.3.20 in \S 4.3.5 in the text.
\end{proof}

\subsubsection{$F\left[  x\right]  $ is a Euclidean domain}

The division-with-remainder theorem for polynomials (Theorem 3.3.8
\textbf{(a)} in Lecture 25, to be specific) looks suspiciously like the
definition of a Euclidean norm in the definition of a Euclidean ring
(Definition 1.13.2 \textbf{(b)} in Lecture 15). Unfortunately, the condition
\textquotedblleft the leading coefficient of $b$ is a unit\textquotedblright%
\ in the former theorem prevents it from literally fitting the bill. However,
when the ring $R$ is a field, every leading coefficient is a unit, and so this
condition is no longer standing in our way. Thus, we obtain the following:

\begin{theorem}
\label{thm.polring.univar-Euc}Let $F$ be a field. Then, the polynomial ring
$F\left[  x\right]  $ is a Euclidean domain. The map%
\begin{align*}
N:F\left[  x\right]   &  \rightarrow\mathbb{N},\\
p  &  \mapsto\max\left\{  \deg p,0\right\}  =%
\begin{cases}
\deg p, & \text{if }p\neq0;\\
0, & \text{if }p=0
\end{cases}
\end{align*}
is a Euclidean norm on $F\left[  x\right]  $.
\end{theorem}

\begin{proof}
Follows from the division-with-remainder theorem for polynomials, as we just explained.
\end{proof}

Theorem \ref{thm.polring.univar-Euc} allows us to apply the whole machinery of
Euclidean domains to $F\left[  x\right]  $. In particular, it yields that
polynomials in $F\left[  x\right]  $ (where $F$ is a field) have gcds and
lcms, and the Euclidean algorithm can be used to compute them, and Bezout's
theorem allows a gcd of two polynomials $a$ and $b$ to be written as $ua+vb$
where $u,v\in F\left[  x\right]  $. Also, it entails that $F\left[  x\right]
$ is a PID (since any Euclidean domain is a PID). See \S 4.3.6 in the text for details.

\subsubsection{Lagrange interpolation}

The easy half of the FTA has yet another consequence:

\begin{corollary}
[uniqueness of the interpolating polynomial]\label{cor.polint.equal}Let $R$ be
an integral domain. Let $a_{0},a_{1},\ldots,a_{n}$ be $n+1$ distinct elements
of $R$. Let $f,g\in R\left[  x\right]  $ be two polynomials of degree $\leq
n$. Assume that%
\[
f\left[  a_{i}\right]  =g\left[  a_{i}\right]  \ \ \ \ \ \ \ \ \ \ \text{for
all }i\in\left\{  0,1,\ldots,n\right\}  .
\]
Then, $f=g$.
\end{corollary}

\begin{proof}
The difference $f-g$ is a polynomial of degree $\leq n$, but has at least
$n+1$ roots (namely, $a_{0},a_{1},\ldots,a_{n}$). This contradicts the easy
half of the FTA unless $f-g=0$. Thus, we must have $f-g=0$; but this means
that $f=g$.
\end{proof}

Corollary \ref{cor.polint.equal} says that a polynomial of degree $\leq n$
over an integral domain is uniquely determined by its values at $n+1$ distinct
elements $a_{0},a_{1},\ldots,a_{n}$ of $R$. So, if you specify the values
$f\left[  a_{0}\right]  ,\ f\left[  a_{1}\right]  ,\ f\left[  a_{2}\right]
,\ \ldots,\ f\left[  a_{n}\right]  $ of a polynomial $f$ of degree $\leq n$ at
$n+1$ given distinct elements $a_{0},a_{1},\ldots,a_{n}$ of $R$, the
polynomial $f$ is uniquely determined. But does such a polynomial $f$ always
exist (for any choice of these values)?

If $R$ is a field, the answer is \textquotedblleft yes\textquotedblright:

\begin{theorem}
[Lagrange interpolation]\label{thm.polint.lagrange}Let $F$ be a field. Let
$n\in\mathbb{N}$.

Let $a_{0},a_{1},\ldots,a_{n}$ be $n+1$ distinct elements of $F$. Let
$b_{0},b_{1},\ldots,b_{n}$ be $n+1$ elements of $F$. Then:

\textbf{(a)} There is a \textbf{unique} polynomial $p\in F\left[  x\right]  $
satisfying $\deg p\leq n$ and%
\begin{equation}
p\left[  a_{i}\right]  =b_{i}\ \ \ \ \ \ \ \ \ \ \text{for all }i\in\left\{
0,1,\ldots,n\right\}  . \label{eq.thm.polint.lagrange.a.pai}%
\end{equation}


\textbf{(b)} This polynomial $p$ is explicitly given by%
\begin{equation}
p=\sum_{j=0}^{n}b_{j}\dfrac{\prod\limits_{k\neq j}\left(  x-a_{k}\right)
}{\prod\limits_{k\neq j}\left(  a_{j}-a_{k}\right)  }.
\label{eq.thm.polint.lagrange.b.fml}%
\end{equation}

\end{theorem}

\begin{proof}
See Theorem 4.3.26 in the text for a detailed proof.

In a nutshell: If $p$ is the polynomial defined by
(\ref{eq.thm.polint.lagrange.b.fml}), then an easy computation shows that $p$
does satisfy $\deg p\leq n$ and (\ref{eq.thm.polint.lagrange.a.pai}) (this is
a computation worth making at least once in your life; it greatly demystifies
the right hand side of (\ref{eq.thm.polint.lagrange.b.fml})). Thus, the
existence part of part \textbf{(a)} follows. The uniqueness follows easily
from Corollary \ref{cor.polint.equal}, and thus part \textbf{(b)} follows as well.
\end{proof}

Theorem \ref{thm.polint.lagrange} allows us to construct (or reconstruct) a
polynomial of degree $\leq n$ over a field $F$ from knowing $n+1$ of its
values (at distinct inputs). This is called \textbf{Lagrange interpolation}.

This kind of interpolation is particularly useful when $F$ is a finite field
such as $\mathbb{Z}/p$ for a prime $p$. Here are two applications:

\begin{itemize}
\item
\textbf{\href{https://en.wikipedia.org/wiki/Shamir's_secret_sharing}{\textbf{Shamir's
Secret Sharing Scheme}}:} Assume that you have a secret $\mathbf{a}$ (a piece
of information, encoded e.g. as a bitstring\footnote{A \textbf{bitstring} is a
tuple of bits (i.e., elements of $\left\{  0,1\right\}  $). This is how
information is usually stored on digital media.}), which you want to
distribute among $n$ people (\textquotedblleft keepers\textquotedblright), by
giving each keeper a \textquotedblleft piece\textquotedblright\ of the secret
(e.g., another bitstring), in such a way that

\begin{itemize}
\item any $k$ keepers (working together) can piece together the secret
$\mathbf{a}$ from their \textquotedblleft pieces\textquotedblright,

\item but any $k-1$ keepers are left completely clueless about $\mathbf{a}$
(that is, they cannot infer anything about $\mathbf{a}$ from their
\textquotedblleft pieces\textquotedblright).
\end{itemize}

How would you do that? Shamir's Secret Sharing Scheme does it as follows:

Fix a prime $p$ such that $p>n$ and $p>2^{N}$, where $N$ is the size of
$\mathbf{a}$ (in bits).

Label the $n$ keepers $1,2,\ldots,n$.

Encode the secret $\mathbf{a}$ as a residue class $\alpha\in\mathbb{Z}/p$.
(This can be done, since $p>2^{N}$. Of course, you have to agree with the
keepers on an encoding; this encoding needs not be kept secret.)

Pick $k-1$ uniformly random elements $\beta_{1},\beta_{2},\ldots,\beta_{k-1}$
of $\mathbb{Z}/p$. (This requires a good random number generator, but such
things can be assumed to exist.)

Let $f$ be the polynomial%
\[
\beta_{k-1}x^{k-1}+\beta_{k-2}x^{k-2}+\cdots+\beta_{1}x+\alpha\in\left(
\mathbb{Z}/p\right)  \left[  x\right]
\]
(which has degree $\leq k-1$).

Give one value of $f$ to each keeper. Specifically, give the value $f\left[
\overline{i}\right]  \in\mathbb{Z}/p$ to keeper $i$. Then, throw the
polynomial $f$ away (and certainly do not share it with the keepers!).

Hence, any $k$ keepers (working together) know $k$ different values of $f$,
and thus can use Lagrange interpolation (specifically, the explicit formula
(\ref{eq.thm.polint.lagrange.b.fml})) to piece together the polynomial $f$
from these values. Hence, they can compute $\alpha$ (as the constant term of
$f$) and thus recover the original secret $\mathbf{a}$.

But $k-1$ keepers $i_{1},i_{2},\ldots,i_{k-1}$ cannot infer anything about
$\alpha$ from their values $f\left[  \overline{i_{1}}\right]  ,\ f\left[
\overline{i_{2}}\right]  ,\ \ldots,\ f\left[  \overline{i_{k-1}}\right]  $.
(This is not completely obvious. The easiest way to see this is as follows:
The element $\alpha$ is the constant term of $f$, so that $\alpha=f\left[
\overline{0}\right]  $. For any $\gamma\in\mathbb{Z}/p$, Theorem
\ref{thm.polint.lagrange} \textbf{(a)} yields a unique polynomial $g_{\gamma}$
of degree $\leq k-1$ that takes this value $\gamma$ at $\overline{0}$ while
taking the values $f\left[  \overline{i_{1}}\right]  ,\ f\left[
\overline{i_{2}}\right]  ,\ \ldots,\ f\left[  \overline{i_{k-1}}\right]  $ at
$\overline{i_{1}},\overline{i_{2}},\ldots,\overline{i_{k-1}}$. From the
viewpoint of our $k-1$ keepers $i_{1},i_{2},\ldots,i_{k-1}$, the polynomial
$f$ can be any of these $p$ polynomials $g_{\overline{0}},g_{\overline{1}%
},\ldots,g_{\overline{p-1}}$, and none of them is more likely than any other
(if $\beta_{1},\beta_{2},\ldots,\beta_{k-1}$ were really chosen uniformly at
random). Thus, $\alpha$ can be any of the values $\overline{0},\overline
{1},\ldots,\overline{p-1}$ with equal probabilities. I.e., our $k-1$ keepers
know nothing about $\alpha$.)

See \cite[\S 23.5]{Smart11} for more about this secret-sharing scheme. Note
that we can use any finite field $F$ instead of $\mathbb{Z}/p$, but in that
case we may have to number our $n$ keepers with some of the nonzero elements
of $F$ (as opposed to $1,2,\ldots,n$).

\item \textbf{Error-correcting codes:} Coding theory is the study of how to
encode information in such a way that minor errors (i.e., changes to just a
few bits) can be corrected or at least detected. This has myriad applications
in communication (e.g., sending digital data over radio or fiber) and data
storage (e.g., hard drives and RAM). Texts written about coding theory easily
fill bookshelves, and many universities have courses dedicated to it. Much
(but not all) of coding theory relies on finite fields (and occasionally more
general rings). Here is just a little taste of the subject:

Imagine that you want to send a message to a recipient via messenger pigeons
(more realistically, \href{https://en.wikipedia.org/wiki/Internet_Protocol}{IP
packets}). Each pigeon can carry an element of $\mathbb{Z}/p$ for a given
prime $p$ (more realistically, a bitstring of a given size, but this can
easily be reduced to $\mathbb{Z}/p$ by picking an appropriate prime $p$). Your
message is a tuple of $n$ elements of $\mathbb{Z}/p$, thus would fit on $n$ of
these pigeons. However, you expect that a few pigeons will be lost on the way,
so you have to build some redundancy into your communication. (We assume that
the pigeons are numbered $1,2,3,\ldots$, so that the recipient will know what
he is missing.)

The easiest way to build redundancy into the system is to send each message
twice, thus using $2n$ instead of $n$ pigeons. This can \textquotedblleft
correct $1$ error\textquotedblright, i.e., your message will still be received
if $1$ pigeon goes missing. Likewise, with $3n$ pigeons, you can afford losing
$2$ pigeons. But this is clearly wasteful (and more pigeons will likely lead
to more loss). Can you do better?

A huge improvement can be obtained using \textquotedblleft
check-sums\textquotedblright: If your message is the tuple $\left(
a_{1},a_{2},\ldots,a_{n}\right)  $, then you can send $n$ pigeons carrying the
elements $a_{1},a_{2},\ldots,a_{n}$, respectively, and an extra
\textquotedblleft checksum\textquotedblright\ pigeon carrying the element
$a_{1}+a_{2}+\cdots+a_{n}\in\mathbb{Z}/p$. If at most $1$ pigeon is lost, your
recipient will be able to infer the missing element from the others, so you
end up correcting $1$ error at the expense of merely $1$ extra pigeon.

Similarly, you can correct $2$ errors by sending two \textquotedblleft
checksum\textquotedblright\ pigeons, one carrying $a_{1}+a_{2}+\cdots+a_{n}$
and another carrying $1a_{1}+2a_{2}+\cdots+na_{n}$ for example. Things get
more complicated for more errors, however.

The situation becomes even more interesting if we allow not just for lost
pigeons, but for pigeons that corrupt (i.e., change) their messages (arguably
not a very likely problem with pigeons, but a pretty common one with data over
the internet or on digital storage). The single checksum $a_{1}+a_{2}%
+\cdots+a_{n}$ will discover the corruption of a single pigeon, although it
will not help correct it (as it is not clear which of the $n+1$ pigeons messed up).

However, polynomials and Lagrange interpolation save our day. We encode our
intended message into a polynomial%
\[
f:=a_{1}x^{0}+a_{2}x^{1}+a_{3}x^{2}+\cdots+a_{n}x^{n-1}\in\left(
\mathbb{Z}/p\right)  \left[  x\right]  ,
\]
and give each pigeon a value of this polynomial (e.g., giving the $i$-th
pigeon the value $f\left[  \overline{i}\right]  $). Now, any $n$ pigeons are
sufficient to reconstruct the polynomial $f$ (and thus the original message)
using Lagrange interpolation. Thus, if we send $n+k$ pigeons on their way,
then $k$ missing pigeons will not destroy the message. Better yet, using
$n+2k$ pigeons, the recipient will be able to reconstruct the message
correctly even if $k$ (or fewer) pigeons corrupt their data. (Theoretically,
this can be done by applying Lagrange interpolation to every possible $\left(
n+k\right)  $-element set of pigeons, yielding a polynomial of degree $\leq
n+k-1$ each time. If this polynomial has degree $\geq n$, then it cannot be
$f$. Using Corollary \ref{cor.polint.equal}, it is not hard to see that only
one polynomial of degree $\leq n-1$ will come out, and that will be $f$,
provided that no more than $k$ pigeons have corrupted their data or gotten
lost. Finding an actually efficient algorithm is trickier.)

This is called a \textbf{Reed--Solomon code} (going back to Reed and Solomon
in 1960, \cite{ReeSol60}), and (just like secret sharing) it can be used with
any finite field instead of $\mathbb{Z}/p$ (and some other choices are more
popular for technical reasons).

We have just touched the surface of coding theory here (and even of just the
theory of Reed--Solomon codes). See \cite[Chapter 3]{MulMum07} for an
introduction to error-correcting codes, and \cite{Garret03} for a more
thorough textbook.
\end{itemize}

\begin{thebibliography}{99999999}                                                                                         %


\bibitem[Aluffi16]{Aluffi16}Paolo Aluffi, \textit{Algebra: Chapter 0},
Graduate Studies in Mathematics \textbf{104}, 2nd printing, AMS 2016.

\bibitem[Garret03]{Garret03}Paul Garrett, \textit{The Mathematics of Coding
Theory}, Prentice Hall 2003.\newline\url{https://www-users.cse.umn.edu/~garrett/coding/CodingNotes.pdf}

\bibitem[Knapp16]{Knapp1}Anthony W. Knapp, \textit{Basic Algebra}, Digital 2nd
edition 2016.\newline\url{http://www.math.stonybrook.edu/~aknapp/download.html}

\bibitem[LaNaSc16]{LaNaSc16}Isaiah Lankham, Bruno Nachtergaele, Anne
Schilling, \textit{Linear Algebra As an Introduction to Abstract Mathematics},
2016.\newline\url{https://www.math.ucdavis.edu/~anne/linear_algebra/mat67_course_notes.pdf}

\bibitem[MulMum07]{MulMum07}%
\href{https://bookstore.ams.org/view?ProductCode=STML/41}{Gary L. Mullen, Carl
Mummert, \textit{Finite Fields and Applications}, Student Mathematical Library
\textbf{41}, AMS 2007.}

\bibitem[ReeSol60]{ReeSol60}%
\href{https://faculty.math.illinois.edu/~duursma/CT/RS-1960.pdf}{I. S. Reed,
G. Solomon, \textit{Polynomial codes over certain finite fields}, J Soc.
Indust. Appl. Math. \textbf{8}, No. 2, June, 1960}.

\bibitem[Smart11]{Smart11}Nigel Smart, \textit{Cryptography: An Introduction},
3rd Edition 2011.\newline%
\url{https://www.cs.umd.edu/~waa/414-F11/IntroToCrypto.pdf} or\newline%
\url{https://homes.esat.kuleuven.be/~nsmart/Crypto_Book/} (with errata).

\bibitem[Steinb06]{Steinb06}Mark Steinberger, \textit{Algebra}, 31 August
2006.\newline\url{https://math.hawaii.edu/~tom/algebra.pdf}

\bibitem[Warner90]{Warner90}Seth Warner, \textit{Modern Algebra: two volumes
bound as one}, Dover 1990.
\end{thebibliography}


\end{document}