Abstract: A share generating device obtains N seeds s0, . . . , sN?1, obtains a function value y=g(x, e) ? Fm of plaintext x ? Fm and a function value e, and obtains information containing a member yi and N?1 seeds sd, where d ? {0, . . . , N?1} and d?i, as a share SSi of the plaintext x in secret sharing and outputs the share SSi. It is to be noted that the function value y is expressed by members y0 ? Fm(0), . . . , yN?1 ? Fm(N?1), which satisfy m=m(0)+ . . . +m(N?1).

Abstract: Falsification is detected during secret computation that uses a plurality of types of secret sharing. A secret computation apparatus 1 uses shared values [a0], . . . , [aM-1] as inputs, and a function value [F([a0], . . . , [aM-1])] obtained with a function F for performing secret computation that uses J types of secret sharing as an output, and detects falsification during secret computation. A random number generating section 12 obtains shared values [r0], . . . , [rJ-1]. A randomizing section 13 multiplies the shared value [am] by the shared value [rj] to calculate a shared value [amrj], and generates a randomized shared value <am>:=<[am], [amrj]>. A secret computation section 14 obtains the function value [F([a0], . . . , [aM-1])] while including, in a checksum Cj, randomized shared values that are computation objects and randomized shared values that are computation results. A synchronizing section 15 keeps idling until all of secret computation that uses secret sharing are completed.

Abstract: An aggregate sum is efficiently obtained while keeping confidentiality. A prefix-sum part computes a prefix-sum from a share of a sorted value attribute. A flag converting part converts a format of a share of a flag representing the last element of a group. A flag applying part generates a share of a vector in which a prefix-sum is set when a flag representing the last element of a group is true, and a sum of the whole is set when the flag is false. A sorting part generates a share of a sorted vector obtained by sorting a vector with a permutation which moves elements so that the last elements of each group are sequentially arranged from beginning. A sum computing part generates a share of a vector representing a sum for each group.

Abstract: In a process of taking a first square matrix formed from elements of a finite field as input and obtaining at least some of entries of a second square matrix which includes an upper triangular portion resulting from triangulation of the first square matrix, product-sum operation is performed on entries as operands at multiple positions in a matrix which is based on the first square matrix to obtain a product-sum operation result corresponding to an entry at a different position than the operands, and reduction of the product-sum operation result is performed.

Abstract: A secure table reference system includes a first combining part 11n for generating [v?] of v? ? Fm+nt in which d and v are combined, a difference calculation part 12n for generating [r?] of r? that has a difference between a certain element of r and an element before the certain element as an element corresponding to the certain element, a second combining part 13n for generating [r?] of r? ? Fm+nt in which r? and an m-dimensional zero are combined, a permutation calculation part 14n for generating {{?}} of a permutation ? that stably sorts v? in ascending order, a permutation application part 15n for generating [s] of s: =?(r?) obtained by applying the permutation ? to r?, a vector generation part 16n for generating [s?] of a prefix-sum s? of s, an inverse permutation application part for generating [s?] of s? obtained by applying an inverse permutation ??1 of the permutation ? to s?, and an output part 17n for generating [x] of x ? Fm consisting of (nt+1)th and subsequent elements of s?.

Abstract: A secure deduplication system, including a plurality of secure computation apparatuses, wherein the plurality of secure computation apparatuses include a plurality of permutation calculation parts 11n for generating a share {{?}} of a permutation ? that stably sorts a vector v in ascending order, a plurality of permutation application parts 12n for generating a share [?(v)] of a vector ?(v) obtained by applying the permutation ? to the vector v, a plurality of vector generation parts 13n for generating a share [e] of a vector e that has 1 as an element corresponding to a certain element when the certain element of the vector ?(v) and an element before the certain element are different, and has 0 otherwise, and a plurality of inverse permutation application parts 14n for generating a share [??1(e)] of a vector ??1(e) obtained by applying an inverse permutation ??1 of the permutation ? to the vector e.

Abstract: A secure computation device obtains a first concealed verification value [z]i=[w??]i with secure computation by using concealed authentication information [w]i which is preliminarily stored and concealed authentication information [?]i which is inputted, obtains a concealed extension field random number [rm]i [F?] which is a secret sharing value of an extension field random number rm, obtains a second concealed verification value [ym]i in which ym is concealed with secure computation by using the first concealed verification value [z]i, and obtains a third concealed verification value [rmym]i with secure computation by using the concealed extension field random number [rm]i and the second concealed verification value [ym]i and outputs the third concealed verification value [rmym]i.

Abstract: A calculation process is efficiently performed to a text file in which one or more records are included, each of the records includes one or more cells having an arbitrary length, and each of the cells includes arbitrary pieces of characters. A parameter setting apparatus sets a maximum value Scsv and a minimum value scsv of a size of character strings for one record by using attribute information as an input, a maximum value Senc of a total size of encode information, a maximum value Sss of a total size of a calculation value obtained by performing specific calculation to the encode information, and a total size Sref of reference information, obtains a function value of C/(Scsv+Senc+Sref) as the number of records which is a process unit of encoding and calculation, and obtains a function value of f0/I·r·Scsv as the number of parallels in the calculation process. Here, C is a cache memory size, M is a main memory size, and f0 is a function value of scsv·M/(scsv+Senc+max(Sref,Sss)).

Abstract: An equality determination unit obtains [ei] in which ei=(ei,1, . . . , ei,N) is concealed, ei in which ei,j=a1 is established when xi,j is kj and ei,j=a0 is established when xi,j is not kj, by secure computation using a concealed search target word [xi] and a concealed search word [k]. A wildcard determination unit obtains [w] in which w=(w1, . . . , wN) is concealed, w in which wj=b1 is established when kj is a wildcard character and wj=b0 is established when kj is not a wildcard character, by secure computation using [k]. An OR operation unit obtains [yi] in which yi=(yi,1, . . . , yi,N) is concealed, yi in which yi,j=d1 is established when at least one of ei,j=a1 and wj=b1 is satisfied and yi,j=d0 is established when at least one of ei,j=a1 and wj=b1 is not satisfied, by secure computation using [ei] and [w].

Abstract: A secure computation apparatus calculates a secret sharing value {si}={xi}?½ using a secret sharing value {xi} of xi (where i=0, 1, 2), calculates a secret sharing value {y}={4s0s1s2}+½ by secure computation using the secret sharing value {si} and outputs the secret sharing value {y}, and calculates a secret sharing value {yr}={4rs0s1s2}+{r}/2 by secure computation using a secret sharing value {r} of a random number r and the secret sharing value {si} and outputs the secret sharing value {yr}.

Abstract: An efficient share recovery technique for Shamir's secret sharing is provided. n share recovery apparatuses p0, . . . , pn?1 generate a share [r]i of a secretly shared value shared through Shamir's secret sharing, which becomes a random number r when restored. k share recovery apparatuses ?0, . . . , ?k?1 calculate a share [b]i by subtracting the share [r]i from a share [a]i. The share recovery apparatus ?k receives the shares [b]0, . . . , [b]k?1 from the share recovery apparatuses ?0, . . . , ?k?1. The share recovery apparatus ?k recovers shares [b]k, . . . , [b]k+m?1 using the shares [b]0, . . . , [b]k?1. m?1 share recovery apparatuses ?k+1, . . . , ?k+m?1 receive a share [b]j from the share recovery apparatus ?k. m share recovery apparatuses ?k, . . . , ?k+m?1 calculate the share [a]j by adding the share [r]j to the share [b]j.

Abstract: A secret share value of object data on which secure computation is to be performed is stored in a secure computation device, and a query which requests secure computation or secret share value of the query is input to the secure computation device. The secure computation device performs consistency verification of the secret share value of the object data and consistency verification of the query or the secret share value of the query, obtains a secret share value of a calculation result by performing secure computation in accordance with the query or the secret share value of the query which passed the consistency verification by using the secret share value of the object data which passed the consistency verification, and outputs the secret share value of the calculation result.

Abstract: A share [x]i of plaintext x in accordance with Shamir's secret sharing scheme is expressed by N shares [x0]i, . . . , [xN?1]i, and each share generating device Ai obtains a function value ri=Pm(i(?))(si) of a seed si, obtains a first calculated value ?i=?(i, i(?))[xi(?)]i+ri using a Lagrange coefficient ?(i, i(?)), a share [xi(?)]i, and the function value ri, and outputs the first calculated value ?i to a share generating device Ai(?). Each share generating device Ai accepts a second calculated value ?i(+), obtains a third calculated value zi=?(i, i(+))[xi]i+?i(+) using a Lagrange coefficient ?(i, i(+)), a share [xi]i, and the second calculated value ?i(+), and obtains information containing the seed si and the third calculated value zi as a share SSi of the plaintext x in secret sharing and outputs the share SSi.

Abstract: To perform permutation processing at high speed. A number-of-elements determination unit (22) calculates the number of elements to be contained in each allocation destination. A start position determination unit (23) calculates a start position corresponding to each allocation destination. An allocation destination determination unit (24) calculates a sequence of values representing allocation destinations in a buffer. A permutation generating unit (25) calculates a sequence of values representing permutation destinations within the respective allocation to destination. An initial position setting unit (31) sets the start position into a value indicating a position within processing corresponding to each allocation destination. A rearrangement unit (32) sets the elements of a vector into the respective allocation destinations in the buffer. A permutation execution unit (33) generates an output vector by executing an arbitrary inverse permutation algorithm on the respective allocation destinations.

Abstract: An assigned share which is a proper subset of a subshare set with a plurality of subshares as elements, and meta information indicating values according to the elements of the subshare set or indicating that the elements are concealed values are stored. When a value according to a provided corresponding value according to a subset of the assigned share is not obtained from the meta information, a provided value according to the provided corresponding value obtained from the subset of the assigned share is outputted. When a value according to an acquired corresponding value according to a subset of an external assigned share, which is a proper subset of the subshare set, is not obtained from the meta information, input of an acquired value according to the acquired corresponding value is accepted. When the acquired value is inputted, a secret share value is obtained at least using the acquired value.

Abstract: The present invention provides a technique for performing confidential sort at a faster speed than in the prior art. A confidential sort system comprises first to Mth apparatuses. The first to Mth apparatuses obtain inverse substitution [[?0?1]] of L-bit stable sort of {?k0}. The first to Mth apparatuses perform, on i=1, . . . , N?1, a process of converting [[?i?1?1]] to hybrid substitution to obtain {?i?1?1}, a process of inversely substituting {?ki} with {?i?1?1} to obtain {?i?1?ki}, a process of obtaining inverse substitution [[??i?1]] of L-bit stable sort of [[?i?1?ki]], a process of synthesizing {?i?1?1} with [[??i?1]] to obtain [[?i?1]]:=[[?i?1?1??i?1]], and a process of converting [[?N?1?1]] to hybrid substitution to obtain {?N?1?1}. The first to Mth apparatuses inversely substitute [[?v]] with {?N?1?1} and output [[?N?1?v]].

Abstract: An agreement apparatus P(i) (where i=0, . . . , n?1) which executes a consensus protocol generates an opinion value with a signature Xij=(xi, sig_i(xi)) including an opinion value xi indicating an opinion and a signature sig_i(xi) on the opinion value xi or information different from the opinion value with the signature Xij as an opinion value with a signature X?ij=(x?ij, e?ij) and outputs the opinion value with the signature X?ij to an agreement apparatus P(j) (where j=0, . . . , n?1, i?j). The agreement apparatus P(j) accepts the opinion value with the signature X?ij and outputs the opinion value with the signature X?ij or information different from the opinion value with the signature X?ij to an agreement apparatus P(m) (where m=0, . . . , n?1, m?i, m?j) as an opinion value with a signature X?ij.

Abstract: An authentication device outputs a first challenge value corresponding to a random number along with a first authentication request. A second challenge value is input to the authentication device along with a second authentication request, and the authentication device outputs a second response value which is obtained by encrypting a value corresponding to the second challenge value by using a common key by a symmetric key cryptosystem. A first response value corresponding to the first challenge value is input to the authentication device, and the authentication device decides whether or not a decrypting result which is obtained by decrypting the first response value by using the common key and a value corresponding to the first challenge value coincide with each other.

Abstract: A secure computation device obtains concealed information {M(i0, . . . , iS?1)} of a table M(i0, . . . , iS?1) having one-variable function values as its members. It is to be noted that M(ib, 0, . . . , ib, S?1) generated by substituting counter values ib, 0, . . . , ib, S?1 into the table M(i0, . . . , iS?1) represents a matrix Mb, ?, ?, which is any one of Mb, 2, 1, . . . , Mb, 3, 2. The secure computation device obtains concealed information {Mb, ?, ?} by secure computation using concealed information {ib, 0}, . . . , {ib, S?1} and the concealed information {M(i0, . . . , iS?1)}, and obtains concealed information {Mb, ?, MU} of a matrix Mb, ?, MU, which is obtained by execution of a remaining process including those processes among a process Pj, 1, a process Pj, 2, a process Pj, 3, and a process Pj, 4, that are performed subsequent to a process P?, ?.

Abstract: Pi and P+ have stored a+?{a0, a1, a2} and b+?{b0, b1, b2} therein, and Pi and P? have stored a??A? and b??B? therein. Here, P+?P(i+1)mod3, P?=P(i?1)mod3, and a and b are arbitrary values and satisfy a=a0+a1+a2 and b=b0+b1+b2, where A? is a complement of a+ in {a0, a1, a2} and B? is a complement of b+ in {b0, b1, b2}. Pi and P+ share r+, Pi and P? share r?, and Pi calculates c+=(a++a?)(b++b?)?a?b?+r+?r?. Pi sends c+ to P+.