Abstract: A secure computation device obtains concealed information {M(i0, . . . , iS?1)} of a table M(i0, . . . , iS?1) having one-variable function values as its members. It is to be noted that M(ib, 0, . . . , ib, S?1) generated by substituting counter values ib, 0, . . . , ib, S?1 into the table M(i0, . . . , iS?1) represents a matrix Mb, ?, ?, which is any one of Mb, 2, 1, . . . , Mb, 3, 2. The secure computation device obtains concealed information {Mb, ?, ?} by secure computation using concealed information {ib, 0}, . . . , {ib, S?1} and the concealed information {M(i0, . . . , iS?1)}, and obtains concealed information {Mb, ?, MU} of a matrix Mb, ?, MU, which is obtained by execution of a remaining process including those processes among a process Pj, 1, a process Pj, 2, a process Pj, 3, and a process Pj, 4, that are performed subsequent to a process P?, ?.

Abstract: Pi and P+ have stored a+?{a0, a1, a2} and b+?{b0, b1, b2} therein, and Pi and P? have stored a??A? and b??B? therein. Here, P+?P(i+1)mod3, P?=P(i?1)mod3, and a and b are arbitrary values and satisfy a=a0+a1+a2 and b=b0+b1+b2, where A? is a complement of a+ in {a0, a1, a2} and B? is a complement of b+ in {b0, b1, b2}. Pi and P+ share r+, Pi and P? share r?, and Pi calculates c+=(a++a?)(b++b?)?a?b?+r+?r?. Pi sends c+ to P+.

Abstract: A computation device accepts a first processing request output from a first external device, executes first processing, which does not involve outputting information to a second external device, of processing based on the first processing request until the first processing request is judged to satisfy a predetermined security level, and executes second processing, which involves outputting information to the second external device, of the processing based on the processing request after the first processing request is judged to satisfy the security level.

Abstract: A secret sharing value of a value represented by a “first target bit string” is used to obtain a secret sharing value of a value represented by a “first check bit string” obtained by setting a value of the most significant bit of the “first target bit string” to a value of a “first check bit” that is lower than the most significant bit. Here, the “first target bit string” corresponds to a null value when the most significant bit is 1 and corresponds to a real number when the most significant bit is 0. Next, the secret sharing value of the value represented by the “first check bit string” is used to obtain secret sharing values of bit values of the least significant bit to “first check bit” of the “first check bit string”.

Abstract: An inconsistency in shares is detected with a small volume of communications traffic. n inconsistency detecting devices generate random numbers si and make the random numbers si public. The n inconsistency detecting devices generate a common random number s which is the sum total of the random numbers s0, . . . , sn?1. The n inconsistency detecting devices calculate shares [c]i. The n inconsistency detecting devices generate shares [r]i, each of which would become a random number r by reconstruction. The n inconsistency detecting devices calculate shares [d]i, each of which would become a judgment value d by reconstruction. One inconsistency detecting device receives shares [d]1, . . . , [d]n?1 from n?1 inconsistency detecting devices. The one inconsistency detecting device restores n?k shares [d]?k, . . . , [d]?n?1 from k shares [d]0, . . . , [d]k?1. The one inconsistency detecting device judges, for j=k, . . . , n?1, whether or not a share [d]j and a share [d]?j coincide with each other.

Abstract: To detect tampering in secure computation while maintaining confidentiality with a little communication traffic. A random number generation part (11) generates [{right arrow over (?)}ri], [{right arrow over (?)}si]. A random number multiplication part (12) computes [{right arrow over (?)}ti]:=[{right arrow over (?)}ri{right arrow over (?)}si]. A secret multiplication part (13) computes [{right arrow over (?)}z]:=[{right arrow over (?)}x{right arrow over (?)}y]. A random number verification part (14) discloses a pi,jth element of each of [{right arrow over (?)}ri], [{right arrow over (?)}si], [{right arrow over (?)}ti] and confirms whether the element has integrity as multiplication. A random number substitution part (15) randomly substitutes elements in each of [{right arrow over (?)}ri], [{right arrow over (?)}si], [{right arrow over (?)}ti] except for the pi,j-th element to generate [{right arrow over (?)}r?i], [{right arrow over (?)}s?i], [{right arrow over (?)}t?i].

Abstract: The present invention can be efficiently applied to secure computation and can achieve a low probability of successful tampering. A tampering detection device includes a parameter storage storing parameters ?ijk for uniformly mapping from two elements of a ring Rq to one element of the ring Rq, a division part 12 dividing N values a0, . . . , aN?1 into sets of q values to generate value vectors A0, . . . , A??1, a generation part 14 generating a checksum c, and a verification part 15 comparing a verification value generated by using the value vectors A0, . . . , A??1 with the checksum c to determine whether or not any of the values a0, . . . , aN?1 has been tampered with. Here, N and q are integers greater than or equal to 2 and ? is a minimum integer greater than or equal to N/q.

Abstract: To reduce the processing amount of a field multiplication. a denotes a k-th order vector whose elements are a0, . . . , ak?1 (a0, . . . , ak?1?GF(xq)). A denotes an n-by-k matrix formed by vertically connecting a identity matrix and a Vandermonde matrix. b denotes an n-th order vector obtained by multiplying the vector a and the matrix A whose elements are b0, . . . , bn?1 (b0, . . . , bn?1?GF(xq)). A vector conversion part 11 generates a ?-th order vector b? using ? elements bp0, . . . , bp??1 of the vector b. An inverse matrix generation part 12 generates a ?-by-? inverse matrix A??1. A plaintext computation part 13 computes elements ae0, . . . , ae??1 of the vector a by multiplying the vector b? and the inverse matrix A??1.

Abstract: A random number acquiring unit 15 obtains a first sequence that comprises values of digits of a random number represented by a binary number as elements. A logical product arithmetic unit 16 obtains a third sequence that is results of elementwise logical product operation between the first sequence and a second sequence that comprises values of digits of one or more Mersenne numbers represented by one or more binary numbers and a zero value as elements.

Abstract: A power is computed at high speed with a small number of communication rounds. A secret computation system that includes three or more secret computation apparatuses computes a share [a?] of the ?-th power of data “a” from a share [a] of data “a” while data “a” is concealed. The share [a] of data “a” and an exponent ? are input to an input unit (step S11). A local operation unit computes the pu-th power of a share [at] of the t-th power of data “a” without communication with the other secret computation apparatuses (step S12). A secret computation unit uses secret computation that requires communication with the other secret computation apparatuses to compute a multiplication in which at least one of the multiplicands is [a(t*p{circumflex over (?)}u)], the computation result of the local operation unit, to obtain the share [a?] (step S13). An output unit outputs the share [a?] (step S14).

Abstract: A vector generation unit generates a vector xn so that xn[i]?xn[j] if kn[i]=kn[j] at i?j. A set generation unit generates a set Bn,j so that individual elements correspond to combinations of the N?1 pieces of elements, which are individually selected from sets M0, . . . , MN?1 other than a set Mn, and xn[j] and the elements for all of the combinations are included. A matrix generation unit generates a matrix Tn? so that the matrix Tn? includes rows identical to Tn[j] in the number equal to the number of elements of the set Bn,j. A key generation unit generates a vector kn? so that elements of the matrix Tn? which correspond to a row identical to Tn[j] correspond to combinations of kn[j] and elements of the set Bn,j and further, the elements of the set Bn,j are different from each other when there are a plurality of rows identical to Tn[j].

Abstract: A secure equijoin technique of generating one table from two tables while curbing the volume of communications traffic is provided. The technique includes: a first permutation generating means 110 that generates a permutation <?> from an element sequence which is generated from the first column of a table L and the first column of a table R; a first column generating means 120 that generates, for j=2, . . . , a, by using the permutation <?>, a prefix sum, and an inverse permutation <??1>, the j-th column of a table J from an element sequence which is generated from the to j-th column of the table L; a join-result element sequence generating means 130 that generates a join-result element sequence from an element sequence ([[1]], . . . , [[1]], [[0]], . . . , [[0]], [[?1]], . . . , [[?1]]) by using the permutation <?>, the prefix sum, and the inverse permutation <??1 >; a second column generating means 140 that generates, for j=a+1, . . .

Abstract: Computational complexity is reduced in accordance with given k and n. A random number generation unit 12 generates random numbers r0 to rk?2 ?GF(xq). A share generation unit 14 generates shares b0 to bn?1 by calculating a product of a vector a=(r0, . . . , rk?2, s), having the random numbers r0 to rk?2 and plaintext s ?GF(xq) as its elements, and a matrix A. A share selection unit 15 generates a vector b?=(bp0, . . . , bpk?1) having, as its elements, k shares bp0 to bpk?1 selected from the shares b0 to bn?1. An inverse-matrix generation unit 16 generates an inverse matrix A??1 of a k-degree square matrix having the p0-th to pk?1-th rows of the matrix A. A plaintext calculation unit 17 restores the plaintext s by multiplying the k-th row of the inverse matrix A??1 and the vector b?.

Abstract: Determination as to whether a nondecreasing sequence exists or not is efficiently made. A sorting part sorts elements of a set Pi in ascending order to generate vectors ti,i+1 and bi,i+1. A merging part generates vectors t0,m and b0,m by repeating the process of merging vectors (ti,j, bi,j) and (tj,k, bj,k) to generate (ti,k, bi,k). A stable-sorting part generates a vector e by coupling and stably sorting vectors bi,j and tj,k. A searching part searches for sets of (?, x, y) in which e[?] is bi,j[x] and e[?+1] is tj,k[y] and generates a set X including all x and a set Y including all y. An extracting part sorts ti,j[x] (x?X) in ascending order to generate a vector ti,k and sorts bj,k[y] (y?Y) in ascending order to generate a vector bi,k. If the length of a vector t0,m is 0, a determining part outputs a result of determination that indicates the absence of a nondecreasing sequence.

Abstract: The positions in a text in which partial character strings in a pattern appear are efficiently detected. A partial-character-string position detecting device 1 takes inputs of a secret text [t] of a text t, a secrete text <p> of a pattern p, a secret text <c> of a vector c, and a secret text <E> of a matrix E and outputs a secret text <H> of a matrix H. A first matrix generating part 20 generates a secret text <F> of a matrix F, in which F[i][j]=E[i][j+i mod n+1] (where it is assumed that E[i][n]=¬c[i]). A second matrix generating part 30 generates a secret text <F?> of a matrix F?, in which F[i][j]=1 is set if c[i]=0 or if c[i]=1 and F[k][j]=1 for every k that is successively c[k]=1, otherwise F[i][j]=0 is set, where k=i, . . . , n?1. A third matrix generating part 40 computes <H[i][j]>=<F[i][j?i mod n+1]>?<c[i]>?¬<c[i?1]> to generate the secrete text <H>.

Abstract: A computation device accepts a first processing request output from a first external device, executes first processing, which does not involve outputting information to a second external device, of processing based on the first processing request until the first processing request is judged to satisfy a predetermined security level, and executes second processing, which involves outputting information to the second external device, of the processing based on the processing request after the first processing request is judged to satisfy the security level.

Abstract: Data processing is performed while personal information is kept concealed. A registrant terminal splits a registration input password and allocates the split pieces to secure computation servers. The secure computation servers verify whether the password matches. The registrant terminal splits target data and allocates the data shared values to the secure computation servers. The secure computation servers store the data shared values. A user terminal splits a utilization input password and allocates the split pieces to the secure computation servers. The secure computation servers verify whether the password matches. The user terminal sends a data processing request to the secure computation servers. The secure computation servers execute secure computation of the data shared values to generate processing result shared values. The user terminal recovers the processing result from the processing result shared values.

Abstract: To reduce the processing amount of a field multiplication. A matrix application apparatus computes a vector b by multiplying a vector a and a matrix A, provided that a denotes a k-th order vector having elements a0, . . . , ak?1 (a0, . . . , ak?1?GF(xq)), b denotes an m-th order vector having elements b0, . . . , bm?1 (b0, . . . , bm?1?GF(xq)), and A denotes a m-by-k Vandennonde matrix. A polynomial multiplication part computes a value bi. An order reduction part designates gi?hif? as the value bi by using a polynomial hi obtained by dividing a part of the value bi having an order equal to or higher than q by Xq and a polynomial gi formed by a part of the value bi having an order lower than q.

Abstract: An authentication device outputs a first challenge value corresponding to a random number along with a first authentication request. A second challenge value is input to the authentication device along with a second authentication request, and the authentication device outputs a second response value which is obtained by encrypting a value corresponding to the second challenge value by using a common key by a symmetric key cryptosystem. A first response value corresponding to the first challenge value is input to the authentication device, and the authentication device decides whether or not a decrypting result which is obtained by decrypting the first response value by using the common key and a value corresponding to the first challenge value coincide with each other.

Abstract: A secret parallel processing device reducing communication amount includes: a randomization unit that obtains a non-randomized input sequence and outputs a randomized sequence obtained by joining the non-randomized sequence and a dummy record sequence formed of a disclosed value and subjecting the joined sequences to random replacement processing and concealed random replacement data obtained by concealing used random replacement data; a calculation unit that obtains the non-randomized sequence, the randomized sequence, and the dummy record sequence, applies a predetermined function to the sequences, and generates an output checksum for each sequence by using calculation procedure data used in the processing of applying the function; and a correctness verification unit that obtains the output checksum for each sequence and the concealed random replacement data, assesses the output checksum for each sequence, and outputs a final test result determining whether the predetermined function has been correctly appl