[proofplan] We count elements of $G$ by order. For each divisor $d$ of $n := |G|$, let $\psi(d)$ denote the number of elements of exact order $d$, so that $\sum_{d \mid n} \psi(d) = n$. The key constraint comes from the fact that $K$ is a field: the polynomial $t^d - 1 \in K[t]$ has at most $d$ roots, which forces $\psi(d) \le \varphi(d)$ for every divisor $d$. Since the Euler totient function satisfies $\sum_{d \mid n} \varphi(d) = n$ as well, the two sums agree term-by-term, giving $\psi(d) = \varphi(d)$ for every $d \mid n$. In particular, $\psi(n) = \varphi(n) \ge 1$, so $G$ contains an element of order $n$ and is therefore cyclic. [/proofplan]

[step:Partition $G$ by element order and express $|G|$ as a divisor sum] Write $n := |G|$. For each positive integer $d$, define \begin{align*} \psi(d) := \#\{g \in G : \operatorname{ord}(g) = d\}. \end{align*} Every element $g \in G$ satisfies $g^n = 1$ (since $|G| = n$ and the order of every element divides the order of the group), so $\operatorname{ord}(g)$ divides $n$. The sets $\{g \in G : \operatorname{ord}(g) = d\}$, as $d$ ranges over the positive divisors of $n$, therefore partition $G$. Summing cardinalities: \begin{align*} \sum_{d \mid n} \psi(d) = |G| = n. \end{align*} [/step]

[step:Bound $\psi(d) \le \varphi(d)$ for each divisor $d$ of $n$ using the root bound in a field]Fix a divisor $d$ of $n$. We show $\psi(d) \le \varphi(d)$. If $\psi(d) = 0$, the inequality holds because $\varphi(d) \ge 1$ for all $d \ge 1$. Suppose $\psi(d) \ge 1$, so there exists $a \in G$ with $\operatorname{ord}(a) = d$. The cyclic subgroup $\langle a \rangle = \{1, a, a^2, \ldots, a^{d-1}\}$ has exactly $d$ elements (since $a$ has order $d$), and each element satisfies $(a^k)^d = (a^d)^k = 1$, so each is a root of the polynomial $t^d - 1 \in K[t]$. Since $K$ is a field, the polynomial ring $K[t]$ is a Euclidean domain. A nonzero polynomial of degree $d$ in a Euclidean domain has at most $d$ roots in $K$. The polynomial $t^d - 1$ has degree $d$, and the $d$ distinct elements $1, a, a^2, \ldots, a^{d-1}$ are all roots, so these account for every root of $t^d - 1$ in $K$. Now consider any $g \in G$ whose order divides $d$. Then $g^d = 1$, so $g$ is a root of $t^d - 1$. By the root count established above, $g \in \{1, a, a^2, \ldots, a^{d-1}\} = \langle a \rangle$. In particular, every element of $G$ with exact order $d$ lies in $\langle a \rangle$. Within the cyclic group $\langle a \rangle$ of order $d$, the element $a^k$ (for $0 \le k \le d - 1$) has order $d / \gcd(k, d)$. Therefore $\operatorname{ord}(a^k) = d$ if and only if $\gcd(k, d) = 1$. The number of integers $k \in \{0, 1, \ldots, d - 1\}$ with $\gcd(k, d) = 1$ is $\varphi(d)$ by definition of the Euler totient function. Hence \begin{align*} \psi(d) = \#\{g \in G : \operatorname{ord}(g) = d\} \le \#\{a^k : 0 \le k \le d - 1,\, \gcd(k, d) = 1\} = \varphi(d). \end{align*} In fact, the argument shows that when $\psi(d) \ge 1$, equality holds: every generator of $\langle a \rangle$ has order $d$ and belongs to $G$, so $\psi(d) = \varphi(d)$. We record the weaker bound $\psi(d) \le \varphi(d)$ for all $d \mid n$, which is all that is needed for the next step.[/step]

[guided]The goal is to compare $\psi(d)$ with $\varphi(d)$ for each divisor $d$ of $n$. The decisive input is the **field property** of $K$: a nonzero polynomial of degree $d$ over a field has at most $d$ roots. This is the only point where the hypothesis that $K$ is a field (rather than an arbitrary commutative ring) enters the proof. To see why the hypothesis is essential, consider the ring $\mathbb{Z}/8\mathbb{Z}$. The polynomial $t^2 - 1$ has four roots in $\mathbb{Z}/8\mathbb{Z}$, namely $1, 3, 5, 7$, because $3^2 = 9 \equiv 1$, $5^2 = 25 \equiv 1$, and $7^2 = 49 \equiv 1 \pmod{8}$. As a consequence, the group of units $(\mathbb{Z}/8\mathbb{Z})^\times = \{1, 3, 5, 7\}$ is isomorphic to $\mathbb{Z}/2\mathbb{Z} \times \mathbb{Z}/2\mathbb{Z}$ and is not cyclic. The root bound fails because $\mathbb{Z}/8\mathbb{Z}$ is not an integral domain. Fix a divisor $d$ of $n$. The case $\psi(d) = 0$ is immediate: $\varphi(d) \ge 1$ for all $d \ge 1$ (since $\gcd(1, d) = 1$), so $0 = \psi(d) \le \varphi(d)$. Suppose instead that some $a \in G$ has $\operatorname{ord}(a) = d$. Form the cyclic subgroup $\langle a \rangle = \{1, a, a^2, \ldots, a^{d-1}\}$. These $d$ elements are distinct (if $a^i = a^j$ with $0 \le i < j \le d - 1$, then $a^{j - i} = 1$ with $0 < j - i < d$, contradicting $\operatorname{ord}(a) = d$). Each satisfies $(a^k)^d = (a^d)^k = 1^k = 1$, so each is a root of $t^d - 1 \in K[t]$. Now we use that $K$ is a field. The polynomial ring $K[t]$ over a field is a Euclidean domain (with the degree function as the Euclidean norm), and in any Euclidean domain, a nonzero polynomial of degree $d$ has at most $d$ roots. Since $t^d - 1$ has degree $d$ and we have already exhibited $d$ distinct roots $\{1, a, \ldots, a^{d-1}\}$, these must be **all** roots of $t^d - 1$ in $K$. Why does this root count control $\psi(d)$? Any element $g \in G$ whose order divides $d$ satisfies $g^d = 1$, making $g$ a root of $t^d - 1$. The root count forces $g \in \langle a \rangle$. In particular, every element of $G$ with exact order $d$ must lie in $\langle a \rangle$. This is the step that confines the elements we are trying to count to a single cyclic group, where we can count them explicitly. It remains to count how many elements of $\langle a \rangle$ have exact order $d$. For $0 \le k \le d - 1$, the element $a^k$ generates $\langle a \rangle$ — and hence has order $d$ — if and only if $\gcd(k, d) = 1$. This follows from the formula $\operatorname{ord}(a^k) = d / \gcd(k, d)$: the order equals $d$ precisely when $\gcd(k, d) = 1$. The number of such integers $k$ in $\{0, 1, \ldots, d - 1\}$ is by definition $\varphi(d)$. Therefore, when $\psi(d) \ge 1$, every element of $G$ of order $d$ is a generator of $\langle a \rangle$, and there are exactly $\varphi(d)$ such generators, so $\psi(d) = \varphi(d)$. Combining the two cases: $\psi(d) \in \{0, \varphi(d)\}$, and in both cases $\psi(d) \le \varphi(d)$.[/guided]

[step:Force equality $\psi(d) = \varphi(d)$ for every divisor by comparing the two divisor sums] The Euler totient function satisfies the identity \begin{align*} \sum_{d \mid n} \varphi(d) = n \end{align*} for all $n \ge 1$. To verify this, observe that the integers $\{1, 2, \ldots, n\}$ are partitioned into classes according to the value of $\gcd(k, n)$. For each divisor $d$ of $n$, the set $\{k : 1 \le k \le n, \, \gcd(k, n) = n/d\}$ is in bijection with $\{j : 1 \le j \le d, \, \gcd(j, d) = 1\}$ via $k = (n/d) \cdot j$, so it has $\varphi(d)$ elements. Summing over all divisors $d$ of $n$ gives $\sum_{d \mid n} \varphi(d) = n$. We now have two identities: \begin{align*} \sum_{d \mid n} \psi(d) &= n, \\ \sum_{d \mid n} \varphi(d) &= n, \end{align*} together with the pointwise bound $\psi(d) \le \varphi(d)$ for every $d \mid n$. If there existed a single divisor $d_0$ of $n$ with $\psi(d_0) < \varphi(d_0)$, then \begin{align*} n = \sum_{d \mid n} \psi(d) = \psi(d_0) + \sum_{\substack{d \mid n \\ d \neq d_0}} \psi(d) < \varphi(d_0) + \sum_{\substack{d \mid n \\ d \neq d_0}} \varphi(d) = \sum_{d \mid n} \varphi(d) = n, \end{align*} a contradiction. Therefore $\psi(d) = \varphi(d)$ for every divisor $d$ of $n$. [/step]

[step:Conclude that $G$ is cyclic by producing a generator of order $n$] Applying the equality from the previous step with $d = n$: \begin{align*} \psi(n) = \varphi(n) \ge 1. \end{align*} The inequality $\varphi(n) \ge 1$ holds for all $n \ge 1$, since $\gcd(1, n) = 1$. Therefore there exists $g \in G$ with $\operatorname{ord}(g) = n = |G|$. The cyclic subgroup $\langle g \rangle$ has order $n$ and satisfies $\langle g \rangle \subset G$. Since $|\langle g \rangle| = |G| = n$ and $G$ is finite, we conclude $\langle g \rangle = G$, so $G$ is cyclic. [/step]