[proofplan] The proof splits into two parts: existence and uniqueness. For existence, set $q := p^d$ and let $L$ be the splitting field of $f(t) = t^q - t$ over $\mathbb{F}_p$. We show the root set $S := \{\alpha \in L : \alpha^q = \alpha\}$ is a subfield of $L$ by verifying closure under arithmetic operations, using the Frobenius identity $(a + b)^p = a^p + b^p$ in characteristic $p$. A formal derivative computation shows $\gcd(f, Df) = 1$, so $f$ has $q$ distinct roots in $L$, giving $|S| = q$. Since $S$ contains all roots, $S = L$. For uniqueness, given any field $K$ with $|K| = q$, Lagrange's theorem applied to $K^{\times}$ shows every element of $K$ is a root of $t^q - t$, forcing $K$ to be the splitting field of $t^q - t$ over $\mathbb{F}_p$. Splitting fields are unique up to isomorphism. [/proofplan] [step:Construct the root set $S$ of $t^q - t$ and verify it is a subfield of the splitting field] Set $q := p^d$. Let $L$ denote the splitting field of the polynomial \begin{align*} f: \mathbb{F}_p[t] &\to \mathbb{F}_p[t], \\ f(t) &:= t^q - t \end{align*} over $\mathbb{F}_p$. Define the root set \begin{align*} S := \{\alpha \in L : \alpha^q = \alpha\}. \end{align*} We verify that $S$ is a subfield of $L$ by checking each subfield axiom. **Contains $0$ and $1$.** Since $0^q = 0$ and $1^q = 1$, both $0$ and $1$ lie in $S$. **Closed under addition.** Let $\alpha, \beta \in S$. We must show $(\alpha + \beta)^q = \alpha + \beta$. The key identity is the iterated Frobenius: in any commutative ring of characteristic $p$, \begin{align*} (a + b)^p = a^p + b^p \end{align*} for all elements $a, b$. This holds because in the binomial expansion $(a + b)^p = \sum_{k=0}^{p} \binom{p}{k} a^k b^{p-k}$, the binomial coefficient $\binom{p}{k} = \frac{p!}{k!(p-k)!}$ is divisible by $p$ for $1 \le k \le p - 1$ (since $p$ is prime and does not divide $k!(p-k)!$), so all intermediate terms vanish in characteristic $p$. Iterating this identity $d$ times: \begin{align*} (a + b)^{p^d} = a^{p^d} + b^{p^d}, \end{align*} which states $(a + b)^q = a^q + b^q$. Since $\alpha^q = \alpha$ and $\beta^q = \beta$: \begin{align*} (\alpha + \beta)^q = \alpha^q + \beta^q = \alpha + \beta. \end{align*} Hence $\alpha + \beta \in S$. **Closed under additive inverses.** Let $\alpha \in S$. Then $(-\alpha)^q = (-1)^q \alpha^q$. Since $q = p^d$ and $p$ is odd, $(-1)^q = -1$, giving $(-\alpha)^q = -\alpha^q = -\alpha$. If $p = 2$, then $-1 = 1$ in $\mathbb{F}_2$, so $(-\alpha)^q = \alpha^q = \alpha = -\alpha$. In either case, $-\alpha \in S$. **Closed under multiplication.** Let $\alpha, \beta \in S$. Then \begin{align*} (\alpha \beta)^q = \alpha^q \beta^q = \alpha \beta, \end{align*} where the first equality uses the multiplicativity of the $q$-th power map (valid in any commutative ring). Hence $\alpha \beta \in S$. **Closed under multiplicative inverses.** Let $\alpha \in S$ with $\alpha \ne 0$. Since $\alpha^q = \alpha \ne 0$, we have $\alpha^{-1} \in L^{\times}$, and \begin{align*} (\alpha^{-1})^q = (\alpha^q)^{-1} = \alpha^{-1}, \end{align*} where the first equality holds because the map $x \mapsto x^q$ is a ring homomorphism from $L$ to $L$, and ring homomorphisms send units to units with $\varphi(u^{-1}) = \varphi(u)^{-1}$. Hence $\alpha^{-1} \in S$. Since $S$ contains $0$ and $1$, is closed under addition, additive inverses, multiplication, and multiplicative inverses, $S$ is a subfield of $L$. [guided] The goal is to show that the roots of $t^q - t$ in the splitting field $L$ form not just a set, but a subfield. This is what makes finite field theory work: the zero set of a single polynomial turns out to carry the full structure of a field. Set $q := p^d$ and let $L$ be the splitting field of $f(t) := t^q - t$ over $\mathbb{F}_p$. Define $S := \{\alpha \in L : \alpha^q = \alpha\}$. We check each subfield axiom. **Contains $0$ and $1$.** Direct computation: $0^q = 0$ and $1^q = 1$. **Closure under addition.** This is the most substantive verification, because it requires the Frobenius identity. In any commutative ring $R$ of characteristic $p$, the binomial theorem gives \begin{align*} (a + b)^p = \sum_{k=0}^{p} \binom{p}{k} a^k b^{p-k}. \end{align*} For $1 \le k \le p - 1$, the binomial coefficient $\binom{p}{k} = \frac{p!}{k!(p-k)!}$ has $p$ dividing the numerator but not the denominator (since $p$ is prime and $1 \le k \le p-1$), so $p \mid \binom{p}{k}$, and these terms vanish in characteristic $p$. Only the $k = 0$ and $k = p$ terms survive: \begin{align*} (a + b)^p = a^p + b^p. \end{align*} Why does this iterate? Applying the identity to $(a + b)^{p^2} = ((a + b)^p)^p = (a^p + b^p)^p = (a^p)^p + (b^p)^p = a^{p^2} + b^{p^2}$. Continuing inductively, after $d$ iterations: \begin{align*} (a + b)^{p^d} = a^{p^d} + b^{p^d}, \end{align*} i.e., $(a + b)^q = a^q + b^q$. For $\alpha, \beta \in S$: \begin{align*} (\alpha + \beta)^q = \alpha^q + \beta^q = \alpha + \beta. \end{align*} This identity — that the $q$-th power map is additive — is sometimes called the "Freshman's dream" in characteristic $p$. It is the essential reason that the root set of $t^q - t$ is closed under addition, a property that has no analogue for generic polynomials. **Closure under additive inverses.** For $\alpha \in S$: if $p$ is odd, $(-1)^q = (-1)^{p^d} = ((-1)^p)^{p^{d-1}} = (-1)^{p^{d-1}}$. Since $p$ is odd, $(-1)^p = -1$, and iterating gives $(-1)^q = -1$. So $(-\alpha)^q = (-1)^q \alpha^q = -\alpha$. If $p = 2$, then $-1 = 1$ in $\mathbb{F}_2$, so $(-\alpha)^q = \alpha^q = \alpha = -\alpha$. Either way, $-\alpha \in S$. **Closure under multiplication.** For $\alpha, \beta \in S$: $(\alpha\beta)^q = \alpha^q \beta^q = \alpha \beta$, using that the $q$-th power map is multiplicative (this holds in any commutative ring, with no characteristic assumption). **Closure under multiplicative inverses.** For $\alpha \in S \setminus \{0\}$: raising $\alpha^q = \alpha$ to the power $-1$ (valid since $\alpha \ne 0$), $(\alpha^{-1})^q = (\alpha^q)^{-1} = \alpha^{-1}$. Having verified all subfield axioms, $S$ is a subfield of $L$. [/guided] [/step] [step:Show $f(t) = t^q - t$ has $q$ distinct roots by computing $\gcd(f, Df)$] We compute the formal derivative of $f(t) = t^q - t$ in $\mathbb{F}_p[t]$: \begin{align*} Df(t) = q \, t^{q-1} - 1. \end{align*} Since $q = p^d$ and the coefficient ring has characteristic $p$, the integer $q = p^d$ maps to $0$ in $\mathbb{F}_p$. Therefore \begin{align*} Df(t) = 0 \cdot t^{q-1} - 1 = -1. \end{align*} The formal derivative is the constant polynomial $-1$, which is a unit in $\mathbb{F}_p[t]$. Consequently, \begin{align*} \gcd(f, Df) = \gcd(t^q - t, \, -1) = 1. \end{align*} Since $\gcd(f, Df) = 1$, the polynomial $f$ has no repeated roots in any extension of $\mathbb{F}_p$. (A polynomial $g$ over a field has a repeated root in some extension if and only if $\gcd(g, Dg) \ne 1$; the contrapositive gives the result.) Since $\deg(f) = q$ and $f$ has no repeated roots, $f$ has exactly $q$ distinct roots in its splitting field $L$. Therefore $|S| = q = p^d$. [guided] A polynomial of degree $q$ has at most $q$ roots in any field, but it might have fewer if there are repeated roots. The formal derivative test detects this. Recall the criterion: a polynomial $g \in K[t]$ over a field $K$ has a repeated root in the algebraic closure $\overline{K}$ if and only if $\gcd(g, Dg) \ne 1$ in $K[t]$. (This follows from the factorisation $g = (t - \alpha)^m h$ with $h(\alpha) \ne 0$: then $Dg = m(t - \alpha)^{m-1} h + (t - \alpha)^m Dh$, so $(t - \alpha) \mid \gcd(g, Dg)$ when $m \ge 2$ or when $m = 1$ and $\operatorname{char}(K) \mid m$, but for $m = 1$ with $\operatorname{char}(K) \nmid 1$ the gcd is $1$.) For $f(t) = t^q - t$, the formal derivative is \begin{align*} Df(t) = q \, t^{q-1} - 1. \end{align*} Now, $q = p^d$, and in $\mathbb{F}_p$ the element $p^d$ equals zero (since $p = 0$ in $\mathbb{F}_p$ and $p^d = \underbrace{p \cdot p \cdots p}_{d} = 0$). Therefore $Df(t) = -1$, a nonzero constant. A nonzero constant is a unit in $\mathbb{F}_p[t]$, so $\gcd(f, Df) = 1$. By the contrapositive of the repeated root criterion, $f$ has no repeated roots in any extension. Since $\deg(f) = q$, the polynomial $f$ has exactly $q$ distinct roots in its splitting field $L$. The root set $S$ consists of exactly these $q$ roots, so $|S| = q = p^d$. It is worth noting why this derivative computation is specific to the polynomial $t^q - t$: the leading coefficient $q = p^d$ is killed by the characteristic, causing the derivative to drop to a constant. For a generic polynomial of degree $q$, the derivative would have degree $q - 1$, and the gcd could be nontrivial. [/guided] [/step] [step:Conclude that $S$ is the splitting field and a field with $p^d$ elements] From the previous two steps: $S$ is a subfield of $L$ with $|S| = q = p^d$, and $S$ consists of all roots of $f(t) = t^q - t$ in $L$. Since $L$ is by definition the splitting field of $f$ over $\mathbb{F}_p$ — the smallest extension of $\mathbb{F}_p$ containing all roots of $f$ — and $S$ is a subfield of $L$ that contains $\mathbb{F}_p$ (as $\alpha^p = \alpha$ for all $\alpha \in \mathbb{F}_p$ by Fermat's little theorem, and $\alpha^q = (\alpha^p)^{p^{d-1}} = \alpha^{p^{d-1}} = \cdots = \alpha$, so $\mathbb{F}_p \subset S$) and contains all roots of $f$, we have $L \subset S$. Combined with $S \subset L$, this gives $S = L$. Therefore the splitting field of $t^{p^d} - t$ over $\mathbb{F}_p$ is a field with exactly $p^d$ elements. This establishes existence. [guided] We must reconcile two facts: $S$ is a subfield of $L$, and $S$ contains all roots of $f$. First, $S$ contains $\mathbb{F}_p$. To see this, let $\alpha \in \mathbb{F}_p$. By Fermat's little theorem (applied to $\mathbb{F}_p^{\times}$, which has order $p - 1$), every nonzero $\alpha \in \mathbb{F}_p$ satisfies $\alpha^{p-1} = 1$, hence $\alpha^p = \alpha$. This also holds for $\alpha = 0$. Therefore $\alpha^q = \alpha^{p^d} = ((\alpha^p)^p)^{\ldots} = \alpha$ (iterating $d$ times), so $\alpha \in S$. Hence $\mathbb{F}_p \subset S$. Second, by definition, $S$ contains every root of $f$ in $L$. Since $L$ is the splitting field of $f$ over $\mathbb{F}_p$, the field $L$ is generated over $\mathbb{F}_p$ by the roots of $f$. But all these roots lie in $S$, and $S$ is itself a field containing $\mathbb{F}_p$. Therefore $L \subset S$ (since $L$ is the smallest such field). Combined with $S \subset L$ (by definition of $S$ as a subset of $L$), we conclude $S = L$. The field $L = S$ has exactly $|S| = q = p^d$ elements. This completes the existence proof: for every prime $p$ and integer $d \ge 1$, the splitting field of $t^{p^d} - t$ over $\mathbb{F}_p$ is a field with $p^d$ elements. [/guided] [/step] [step:Prove uniqueness: any field with $p^d$ elements is the splitting field of $t^q - t$] Let $K$ be any field with $|K| = q = p^d$. We show that $K$ is a splitting field of $f(t) = t^q - t$ over $\mathbb{F}_p$, and then invoke the uniqueness of splitting fields. **$K$ has characteristic $p$.** Since $K$ is a finite field, $\operatorname{char}(K) = p'$ for some prime $p'$ (a finite field has prime characteristic). The prime subfield of $K$ is $\mathbb{F}_{p'}$, and $K$ is a finite extension of $\mathbb{F}_{p'}$, say $[K : \mathbb{F}_{p'}] = e$. Then $|K| = (p')^e$. Since $|K| = p^d$, unique prime factorisation forces $p' = p$ and $e = d$. Therefore $\operatorname{char}(K) = p$ and $\mathbb{F}_p$ is the prime subfield of $K$. **Every element of $K$ is a root of $t^q - t$.** The multiplicative group $K^{\times}$ is a finite group of order $|K| - 1 = q - 1$. By Lagrange's theorem, every element $\alpha \in K^{\times}$ satisfies $\alpha^{q-1} = 1$, hence $\alpha^q = \alpha$. For $\alpha = 0$, we also have $0^q = 0$. Therefore every element of $K$ satisfies $\alpha^q = \alpha$, i.e., every element of $K$ is a root of $f(t) = t^q - t$. **$K$ accounts for all roots of $f$.** Since $\deg(f) = q$, the polynomial $f$ has at most $q$ roots in any field. We have found $|K| = q$ distinct elements of $K$ that are roots of $f$. Therefore the roots of $f$ in $K$ (and in any extension) are exactly the elements of $K$, and $f$ splits completely over $K$: \begin{align*} t^q - t = \prod_{\alpha \in K} (t - \alpha) \quad \text{in } K[t]. \end{align*} **$K$ is the splitting field.** The polynomial $f = t^q - t$ lies in $\mathbb{F}_p[t]$ (since $\mathbb{F}_p \subset K$ and the coefficients $1, 0, \ldots, 0, -1$ lie in $\mathbb{F}_p$). The field $K$ contains all roots of $f$, and no proper subfield of $K$ can contain all $q$ roots (such a subfield would need at least $q$ elements, but $|K| = q$ is the smallest field with that many elements). Therefore $K$ is the splitting field of $t^q - t$ over $\mathbb{F}_p$. **Uniqueness up to isomorphism.** Any two splitting fields of a polynomial over a given base field are isomorphic via an isomorphism fixing the base field. (This is a standard consequence of the extension theorem for field homomorphisms: given the splitting field $L_1$ of $g \in K[t]$ and any extension $L_2$ of $K$ in which $g$ splits, there exists a $K$-embedding $L_1 \hookrightarrow L_2$. When both $L_1$ and $L_2$ are splitting fields, the embedding is an isomorphism by a degree comparison.) Since any field with $q$ elements is a splitting field of $t^q - t$ over $\mathbb{F}_p$, any two fields with $q$ elements are isomorphic. [guided] The uniqueness argument reverses the existence construction: instead of building a field from the polynomial, we start with a given field $K$ of order $q$ and show it must be the splitting field of the same polynomial $t^q - t$. **Step 1: Identify the characteristic and prime subfield.** A finite field has prime characteristic (if $\operatorname{char}(K) = 0$, then $K$ contains $\mathbb{Q}$, which is infinite, contradicting $|K| < \infty$). Let $\operatorname{char}(K) = p'$. The prime subfield is $\mathbb{F}_{p'} \cong \mathbb{Z}/p'\mathbb{Z}$, and $K$ is a vector space over $\mathbb{F}_{p'}$ of some finite dimension $e$. Counting elements: $|K| = (p')^e$. Since $|K| = p^d$ and both $p, p'$ are primes, unique prime factorisation gives $p' = p$ and $e = d$. **Step 2: Show every element of $K$ satisfies $\alpha^q = \alpha$.** This is the heart of the uniqueness argument. The multiplicative group $K^{\times}$ has order $q - 1$. By Lagrange's theorem applied to the finite group $K^{\times}$: for every $\alpha \in K^{\times}$, the order of $\alpha$ divides $|K^{\times}| = q - 1$. Therefore $\alpha^{q-1} = 1$, and multiplying both sides by $\alpha$ gives $\alpha^q = \alpha$. For $\alpha = 0$: $0^q = 0 = \alpha$, so the identity $\alpha^q = \alpha$ holds for all $\alpha \in K$. This means every element of $K$ is a root of $f(t) = t^q - t$. **Step 3: Conclude $f$ splits completely as a product of linear factors over $K$.** We have $q = |K|$ distinct roots of $f$ in $K$, and $\deg(f) = q$, so $f$ cannot have any roots outside $K$. By the factor theorem applied $q$ times: \begin{align*} t^q - t = \prod_{\alpha \in K}(t - \alpha). \end{align*} This is an identity in $K[t]$: both sides are monic of degree $q$ with the same $q$ roots, so they are equal. **Step 4: Why $K$ is the splitting field, not just a field where $f$ splits.** A splitting field of $f$ over $\mathbb{F}_p$ is the smallest extension of $\mathbb{F}_p$ over which $f$ splits completely. The field $K$ contains $\mathbb{F}_p$ (its prime subfield) and all roots of $f$. Could a proper subfield $K' \subsetneq K$ also contain all roots? No: $K'$ would need to contain all $q$ distinct roots, hence $|K'| \ge q$. But $|K'|$ divides $|K| = q$ (since $K'$ is a subfield of the finite field $K$, the degree $[K : K']$ divides $[K : \mathbb{F}_p] = d$, and $|K'| = p^{d'}$ for some $d' \mid d$ with $d' < d$, giving $|K'| = p^{d'} < p^d = q$). This contradicts $|K'| \ge q$. Therefore $K$ is the splitting field of $f$ over $\mathbb{F}_p$. **Step 5: Apply uniqueness of splitting fields.** Splitting fields of a given polynomial over a given base field are unique up to isomorphism (fixing the base field). Since every field of order $q = p^d$ is a splitting field of $t^q - t$ over $\mathbb{F}_p$, any two such fields are isomorphic. This completes the proof: the field $\mathbb{F}_{p^d}$, defined as the splitting field of $t^{p^d} - t$ over $\mathbb{F}_p$, exists and is the unique field (up to isomorphism) with $p^d$ elements. [/guided] [/step]