Which primes have the form a squared + ab + b squared?

A companion to the sum-of-two-squares theorem

The prime case of Fermat's sum-of-two-squares theorem says that a prime is a sum of two nonzero integer squares exactly when it is two or is congruent to one modulo four.

A related representation replaces the square lattice of Gaussian integers with the triangular lattice of Eisenstein integers:

$$\boxed{p=a^2+ab+b^2\text{ for nonzero integers }a,b \quad\Longleftrightarrow\quad p=3\text{ or }p\equiv1\pmod3.}$$

The original article presents an exploratory commutative-algebra proof. The argument below retains its three-stage structure while making the quotient maps, norm bounds, and strict ideal inclusions explicit. This is a companion representation theorem, rather than a claim that the result is new or that it logically contains the sum-of-two-squares theorem.

For example,

$$3=1^2+1\cdot1+1^2,\quad 7=1^2+1\cdot2+2^2,\quad 13=1^2+1\cdot3+3^2.$$

There is a quick necessary congruence: $a^2+ab+b^2\equiv(a-b)^2\pmod3$, so a prime with such a representation is either three or congruent to one. The harder direction is showing that every prime congruent to one has a representation.

The ring and its norm

Put

$$\omega=\frac{-1+\sqrt{-3}}2,\qquad R=\mathbb Z[\omega].$$

Then $\omega^2+\omega+1=0$, and every element of $R$ has a unique expression $u+v\omega$ with $u,v\in\mathbb Z$. Uniqueness follows because $\omega$ is nonreal.

Complex conjugation preserves $R$, since $\bar\omega=-1-\omega$. Define

$$N(z)=z\bar z=|z|^2.$$

For $z=a-b\omega$,

$$N(a-b\omega)=a^2+ab+b^2 =\left(a+\frac b2\right)^2+\frac34b^2.$$

Thus a nonzero element has a positive integer norm, and $N(zw)=N(z)N(w)$. An element is a unit exactly when its norm is one: its conjugate then supplies an inverse, while a multiplicative inverse forces the product of two positive integer norms to be one.

For $p>3$, we will prove

$$p\equiv1\pmod3 \ \Longleftrightarrow\ (X^2+X+1)\text{ is not maximal in }\mathbb F_p[X]$$ $$\Longleftrightarrow\ pR\text{ is not maximal in }R \ \Longleftrightarrow\ p=N(a-b\omega).$$

Here $(f)$ is the ideal of multiples of $f$. An ideal is maximal when it is proper and no ideal lies strictly between it and the whole ring.

Stage 1: factor a polynomial over a finite field

Why every ideal of the polynomial ring is principal

Let $I$ be a nonzero ideal of $\mathbb F_p[X]$, and choose a nonzero polynomial $A\in I$ of least degree. Divide any $f\in I$ by $A$:

$$f=AQ+S,\qquad\deg S<\deg A\text{ if }S\ne0.$$

The remainder $S=f-AQ$ also lies in $I$, so minimality forces $S=0$. Thus $I=(A)$. The zero ideal is $(0)$ as well.

Consequently, for the monic quadratic $h=X^2+X+1$, the ideal $(h)$ fails to be maximal exactly when $h$ factors into linear factors. If $h=(X-u)(X-v)$, then

$$(h)\subsetneq(X-u)\subsetneq\mathbb F_p[X].$$

Conversely, an ideal strictly between $(h)$ and the whole ring has a generator of degree one, and that generator divides $h$.

When does the quadratic split?

For $p>3$, a repeated root is impossible. A common root of $h$ and $h'=2X+1$ would be $-1/2$, but $h(-1/2)=3/4\ne0$ in $\mathbb F_p$.

By Fermat's little theorem,

$$X^{p-1}-1=\prod_{u\in\mathbb F_p^\times}(X-u).$$

The roots of $h$, if present, are distinct and nonzero. Hence $h$ splits over $\mathbb F_p$ exactly when it divides $X^{p-1}-1$.

To determine that divisibility, work modulo $h$. Since $X^3-1=(X-1)h$, we have $X^3\equiv1\pmod h$.

• If $p\equiv1\pmod3$, then $p-1$ is divisible by three, so $X^{p-1}-1\equiv0\pmod h$.
• If $p\equiv2\pmod3$, then $p-1\equiv1\pmod3$, so the remainder is $X-1$, which is nonzero and has degree less than two.

A prime greater than three is not divisible by three. This proves the first equivalence.

Stage 2: identify the quotient ring

Evaluation at $\omega$ gives a surjective homomorphism

$$\mathbb Z[X]\longrightarrow R,\qquad f\longmapsto f(\omega).$$

Its kernel is $(h)$. Indeed, division by the monic polynomial $h$ works with integer coefficients, giving $f=hq+(u+vX)$. If $f(\omega)=0$, then $u+v\omega=0$, forcing $u=v=0$.

Therefore

$$R\simeq\mathbb Z[X]/(h).$$

Reducing coefficients modulo $p$ gives

$$\boxed{R/pR\simeq\mathbb Z[X]/(p,h) \simeq\mathbb F_p[X]/(h).}$$

These are ring isomorphisms. A quotient by a proper ideal is a field exactly when that ideal is maximal. Hence $(h)$ is maximal in $\mathbb F_p[X]$ exactly when $pR$ is maximal in $R$.

One can also express this through the ideal correspondence: ideals containing a kernel correspond to ideals in the quotient by image and inverse image. It is the correspondence on ideals that is bijective; the original reduction homomorphism is generally not injective.

Stage 3: every ideal of R is principal

We need Euclidean division for the norm. Given complex $z$, express it uniquely as $s+t\omega$ with real $s,t$. Round $s,t$ to nearest integers $m,n$, and put $q=m+n\omega$. Then

$$z-q=u+v\omega,\qquad |u|,|v|\le\frac12,$$

and

$$|z-q|^2=u^2-uv+v^2\le\frac34<1.$$

For $\alpha,\beta\in R$ with $\alpha\ne0$, apply this to $z=\beta/\alpha$. With $r=\beta-q\alpha$,

$$\beta=q\alpha+r,\qquad N(r)<N(\alpha).$$

The lattice picture motivates approximation, but the centered rounding estimate above supplies the strict norm bound. An arbitrary point in an uncentered fundamental rhombus need not have smaller norm than its edge length.

Now choose a nonzero element $\alpha$ of a nonzero ideal $I$ with least positive norm. Dividing any $\beta\in I$ by $\alpha$ leaves $r\in I$. The strict norm bound forces $r=0$. Thus $I=(\alpha)$. The zero ideal is principal too.

From a nonmaximal ideal to a norm representation

Suppose $pR$ is not maximal. Since it is proper, there is an ideal

$$pR\subsetneq I\subsetneq R.$$

Write $I=(\alpha)$. Because $p\in I$, we have $p=\alpha\beta$ for some $\beta\in R$. Both factors are nonzero, and

$$p^2=N(\alpha)N(\beta).$$

The positive integer norm pairs can only be $(1,p^2)$, $(p,p)$, or $(p^2,1)$. If $N(\alpha)=1$, then $\alpha$ is a unit, contradicting $I\ne R$. If $N(\beta)=1$, then $\alpha$ is associated to $p$, contradicting $I\ne pR$.

Therefore $N(\alpha)=p$. Write $\alpha=a-b\omega$ to obtain

$$p=a^2+ab+b^2.$$

Neither coefficient can be zero: otherwise a prime would be an integer square.

From a representation to a nonmaximal ideal

Conversely, suppose $p=N(\alpha)$ for $\alpha=a-b\omega$. Since $p=\alpha\bar\alpha$, we have $pR\subseteq(\alpha)$. The ideal $(\alpha)$ is proper because its generator has norm $p>1$ and is not a unit.

The inclusion is strict. If $\alpha=p\gamma$ for some $\gamma\in R$, then $p=N(\alpha)=p^2N(\gamma)$, impossible for a positive integer $N(\gamma)$. Thus $\alpha\notin pR$ and

$$pR\subsetneq(\alpha)\subsetneq R.$$

This proves the last equivalence.

Finish the exceptional primes

All three stages apply for $p>3$. For $p=3$, take $a=b=1$. For $p=2$, the congruence $a^2+ab+b^2\equiv(a-b)^2\pmod3$ rules out a representation because two is not a square modulo three.

We have therefore proved the criterion for every prime, with the required nonzero coefficients. The central connection is that factorization of a polynomial modulo $p$ detects the failure of $p$ to remain prime in a larger ring, and the multiplicative norm turns that factorization into an integer representation.