A note on the Gauss sum proof of quadratic reciprocity

02/08/2025

Recently, I happened upon the following MathOverflow thread about the "best" proofs of the quadratic reciprocity law. One particular answer caught my eye, which explains how the usual Gauss sum proof, say as given in Serre’s Cours d’arithmétique, falls out of the Galois theory of $\mathbf{Q}(\zeta_{p})$ and $\mathbf{F}_{q}$ , where $p, q$ are the odd primes in question. In fact, the resulting proof is not only highly conceptual, but it is also offers a "plausible" path by which one could discover quadratic reciprocity! The goal of this post is to give a leisurely account of the proof in this spirit.

Let $p$ be an odd prime. We want to start by understanding why a (different) odd prime $q$ being a square modulo $p$ should have anything to due to squares modulo $q$ , let alone whether $p$ is a square modulo $q$ . The answer lies in the isomorphism $(\mathbf{Z}/(p))^\times \cong \mathrm{Gal}(\mathbf{Q}(\zeta_p)/\mathbf{Q})$ . For starters, the square classes are the index 2 subgroup of $(\mathbf{Z}/(p))^\times$ , so Galois theory tells us the corresponding automorphisms of $\mathbf{Q}(\zeta_p)$ over $\mathbf{Q}$ should fix a quadratic subfield $\mathbf{Q} \subseteq \mathbf{Q}(\sqrt{d}) \subseteq \mathbf{Q}(\zeta_p)$ , for some square-free integer $d$ . Then, since $q$ is a unit modulo $p$ , whether or not the automorphism $\zeta_p \mapsto \zeta_p^q$ fixes $\sqrt{d}$ tells us if $q$ is a square modulo $p$ . Concretely, this automorphism sends $\sqrt{d}$ to $\begin{pmatrix} q \\ p \end{pmatrix} \sqrt{d}$ . Stepping back, it is not hard to see that such an element $\alpha$ should exists without using Galois theory. If $\sum_{n \in \mathbf{Z}/(p)^\times} a_n \zeta_p^n$ is any element of $\mathbf{Q}(\zeta_p)$ , then the automorphism $\zeta_p \mapsto \zeta_p^q$ sends it to $\sum_{n \in \mathbf{Z}/(p)^\times} a_n \zeta_p^{nq} = \sum_{n \in \mathbf{Z}/(p)^\times} a_{nq^{-1}} \zeta_p^{n}$ . So if $q$ is a square, we want $a_{nq^{-1}} = a_n$ and if not we want $a_{nq^{-1}} = - a_n$ , but this is accomplished simply by using $a_n = \begin{pmatrix}n \\ p\end{pmatrix}$ . And voilà, the quadratic Gauss sum appears! The action of the Galois group on $\alpha$ implies that it is equal to $c \sqrt{d}$ for some $c \in \mathbf{Q}^\times$ and that $\alpha^2 \in \mathbf{Q}$ . In fact, since by construction $\alpha \in \mathbf{Z}[\zeta_p]$ and $\mathbf{Z}$ is integrally closed, we must have $\alpha^2 \in \mathbf{Z}$ . This means $c \in \mathbf{Z}$ by our assumption that $d$ is square-free. We have $\mathbf{Z}[\alpha] \cong \mathbf{Z}[x]/(x^2 - d')$ , with $d' = c^2 d$ .

Now we can connect things to squares modulo $q$ via the obvious isomorphisms $\mathbf{Z}[\alpha]/(q) \cong \mathbf{Z}[x]/(q, x^2 - d') \cong \mathbf{F} [x]/(x^2 - d')$ $A := \mathbf{F_q}[x]/(x^2 - d')$ depends on $\begin{pmatrix} d' \\ q\end{pmatrix}$ in the following way: if $d'$ is 0 modulo $q$ , then $A$ is the dual numbers over $\mathbf{F}_q$ . If $d'$ is a non-zero square, then since $q$ is odd $x^2 - d'$ has two distinct roots in $\mathbf{F}_q$ , so $A \cong \mathbf{F}_q \times \mathbf{F}_q$ , and if $d'$ is not a square, $A \cong \mathbf{F}_{q^2}$ . But all of these rings can be distinguished from one another by the Frobenius endomorphism, which is nothing but the Galois action $\zeta_p \mapsto \zeta_p^q$ on $\mathbf{Z}[\alpha]$ modulo $q$ . Precisely, letting $\alpha_q = \sum_{n \in \mathbf{Z}/(p)^\times} \begin{pmatrix} n \\ p \end{pmatrix} (\zeta_p^{q})^n$ , we have that the images of $\alpha_q$ and $\alpha^q$ coincide in $A$ . Assuming that $q$ does not divide $d'$ , and letting $\bar{\alpha}$ , $\bar{\alpha}_q$ denote the respective images of $\alpha, \alpha_q$ in $A$ , the Frobenius endomorphism on $A$ is either the identity, so in particular fixes $\bar{\alpha}$ , or it sends $\bar{\alpha}$ to $- \bar{\alpha}$ . Our characterisation of $A$ shows that $\bar{\alpha}^q = \begin{pmatrix} d' \\ q \end{pmatrix} \bar{\alpha}$ , but we have just noted that $\bar{\alpha}^q = \bar{\alpha}_q = \begin{pmatrix} q \\ p \end{pmatrix} \bar{\alpha}$ hence $\begin{pmatrix} q \\ p \end{pmatrix} = \begin{pmatrix} d' \\ q \end{pmatrix}$ .

Now, we need only compute $d' = \alpha^2$ (and hope it gives us a nice answer!). To this end, it will be useful to fix $\zeta_p$ as the complex number $\mathrm{exp}(2 \pi i / p)$ , then $\alpha$ is just the the Fourier transform $F$ (with respect to the group $\mathbf{Z}/(p)$ ) of the Legendre symbol, evaluated at the character $n \mapsto \zeta_p^n$ . For $m$ coprime to $p$ , and $\chi_m \in \widehat{\mathbf{Z}/(p)}$ , defined by $\chi(n) = \zeta_p^{n m}$ , $F(\chi_m) = \pm \alpha$ , as this is just a conjugate of $\alpha$ under $\zeta_p \mapsto \zeta_p^m$ . $F$ evaluated at the trivial character is 0, since there is an equal amount of non-zero squares and non-squares modulo $p$ . A useful property of the Fourier transform is the Plancherel formula, that is $||f||^2 = ||\hat{f}||^2$ . In the case of $\mathbf{Z}/(p)$ , this is expressed as $\sum_{n \in \mathbf{Z}/(p)} |f(n)|^2 = \frac{1}{p} \sum_{\chi \in \widehat{\mathbf{Z}/(p)}} |\hat{f}(\chi)|^2$ since the dual measure on $\widehat{\mathbf{Z}/(p)}$ with respect to the counting measure on $\mathbf{Z}/(p)$ is the normalised counting measure. If $f$ is the Legendre symbol, the formula gives $p-1 = \frac{p-1}{p} |\alpha|^2$ , i.e. $|d'| = p$ . Great! We now know that our assumption that $d'$ is coprime to $q$ was valid, and so we can use the formula $\begin{pmatrix} q \\ p \end{pmatrix} = \begin{pmatrix} d' \\ q \end{pmatrix} = \begin{pmatrix} \pm p \\ q \end{pmatrix}$ , so we need only work out the sign. To do this, we just need to look at how $\alpha$ behaves under complex conjugation, since the sign of $d'$ corresponds to $\alpha$ being real or imaginary. In $\mathbf{Q}(\zeta_p) \subseteq \mathbf{C}$ , complex conjugation restricts to the automorphism defined by $\zeta_p \mapsto \zeta_p^{-1}$ , so the complex conjugate of $\alpha$ is $\begin{pmatrix} -1 \\ p \end{pmatrix} \alpha = (-1)^{\frac{p-1}{2}} \alpha$ . We thus conclude that $d' = (-1)^{\frac{p-1}{2}} p$ . A quick computation with Legendre symbols then yields $\begin{pmatrix} q \\ p \end{pmatrix} = \begin{pmatrix} -1 \\ q \end{pmatrix}^\frac{p-1}{2} \begin{pmatrix} p \\ q \end{pmatrix} = (-1)^{\frac{q-1}{2} \frac{p-1}{2}} \begin{pmatrix} p \\ q \end{pmatrix}$ or in its more traditional form $\begin{pmatrix} p \\ q \end{pmatrix} \begin{pmatrix} q \\ p \end{pmatrix} = (-1)^{\frac{p-1}{2} \frac{q-1}{2}}$ QED