Unified Field Extension Solution of Quadratic Equations over Finite Fields: Galois Symmetry and the Norm Method

Classical solution of quadratic congruence equations over a finite field Fₚ relies on the Legendre symbol (Δ/p) as a preliminary criterion, thereby splitting the equation into two separate algebraic branches: solvable and unsolvable. Starting from algebraic extensions and Galois theory, this paper lifts the solution space from the base field Fₚ to the quadratic extension Fp², constructing a unified algebraic solution paradigm that bridges this rupture within the extension field. Chapter 1 constructs a canonical extension K = Fₚ(θ) by fixing a quadratic non-residue, proves that the square root of any discriminant Δ exists unconditionally in this unified field, and thereby endows the quadratic formula x = (-b ± √Δ)/(2a) with universality at the algebraic-existence level; the original dichotomous criterion based on the discriminant's property now manifests as the positional characteristic of the solutions in K (solutions lie in the base field when Δ is a residue, and in the non-trivial part of the extension otherwise). Chapter 2 reveals that the Galois group of K/Fₚ is generated by the Frobenius automorphism φ(α)=αᵖ, which, under a power basis representation, is equivalent to φ(a+bθ)=a-bθ; this extends the conjugate symmetry between the two roots to an arbitrary discriminant; based on this symmetry, the fact that the sum and product in Vieta's formulas always belong to the base field receives a natural interpretation as Galois invariants. Chapter 3 points out that the algebraic core of the Cipolla square-root algorithm is the extraction of the square root of the extension field norm, namely ((t+ω)(p+1)/2)² = Δ; accordingly, the square-root extraction can be performed along a unified Fp² arithmetic path. The algorithm relocates the object of the Legendre symbol determination from the input data Δ to a randomly derived parameter t²-Δ; the core root-finding path executes an identical sequence of algebraic operations for all Δ, and the residue property of the discriminant is revealed a posteriori by the ω-coefficient of the computed result. This paradigm transfers the branching condition based on the sensitive input Δ onto a random derivative parameter, keeping the core computation path uniform for all inputs, and thus provides a beneficial structural property for side-channel-secure constant-time implementations.