Problem: For a prime $p$, a subset $S$ of residues modulo $p$
is called a \emph{sum-free multiplicative subgroup}
of $\FF_p$ if
\begin{itemize}
  \ii there is a nonzero residue $\alpha$ modulo $p$
  such that $S = \left\{ 1, \alpha^1, \alpha^2, \dots \right\}$
  (all considered mod $p$), and
  \ii there are no $a,b,c \in S$
  (not necessarily distinct) such that $a+b \equiv c \pmod p$.
\end{itemize}
Prove that for every integer $N$,
there is a prime $p$ and a sum-free multiplicative subgroup $S$
of $\FF_p$ such that $\left\lvert S \right\rvert \ge N$.

\end{enumerate}

Solution: We first prove the following general lemma.

\begin{lemma*}
  If $f,g \in \ZZ[X]$ are relatively prime nonconstant polynomials,
  then for sufficiently large primes $p$,
  they have no common root modulo $p$.
\end{lemma*}
\begin{proof}
  By B\'{e}zout Lemma,
  there exist polynomials $a(X)$ and $b(X)$ in $\ZZ[X]$
  and a nonzero constant $c \in \ZZ$ satisfying the identity
  \[ a(X) f(X) + b(X) g(X) \equiv c. \]
  So, plugging in $X = r$ we get $p \mid c$,
  so the set of permissible primes $p$ is finite.
\end{proof}

With this we can give the construction.
\begin{claim*}
  Suppose that
  \begin{itemize}
    \ii $n$ is a positive integer with $n \not\equiv 0 \pmod 3$;
    \ii $p$ is a prime which is $1 \bmod n$; and
    \ii $\alpha$ is a primitive $n$'th root of unity modulo $p$.
  \end{itemize}
  Then $|S| = n$ and, if $p$ is sufficiently large in $n$,
  is also sum-free.
\end{claim*}
\begin{proof}
  The assertion $|S|=n$ is immediate from the choice of $\alpha$.
  As for sum-free, assume for contradiction that
  \[ 1 + \alpha^k \equiv \alpha^m \pmod p \]
  for some integers $k,m \in \ZZ$.
  This means $(X+1)^n-1$ and $X^n-1$ have common root $X=\alpha^k$.

  But
  \[ \gcd_{\ZZ[x]} \Big( (X+1)^n-1, \; X^n-1 \Big)
    = 1 \qquad \forall n \not\equiv 0 \pmod 3 \]
  because when $3 \nmid n$ the two polynomials
  have no common complex roots.
  (Indeed, if $|\omega| = |1+\omega| = 1$
  then $\omega = -\half \pm \frac{\sqrt3}{2}i$.)

  Thus $p$ is bounded by the lemma, as desired.
\end{proof}