Abstract: A decomposition unit (211) decomposes an exponent portion of a final exponentiation computation portion of pairing computation in an elliptic curve into an easy part and a hard part, the elliptic curve being expressed by a polynomial r(x), a polynomial p(x), a polynomial t(x), an embedding degree k, and an integer u. A factorization unit (212) factorizes the hard part with using a homogeneous cyclotomic polynomial ?n(x, p). An exponentiation computation unit (22) performs computation of final exponentiation with using the easy part and the factorized hard part.

Abstract: A decomposition unit (211) decomposes an exponent portion of a final exponentiation computation portion of pairing computation in an elliptic curve into an easy part and a hard part with using a polynomial ?k(p(x)), the elliptic curve being expressed by: a polynomial r(x)=?k(T(x))/h2(x), a polynomial p(x)=h1(x)r(x)+T(x), and a polynomial t(x)=T(x)+1 which are expressed with using a cyclotomic polynomial ?k(x) having a degree d, a polynomial T(x), a polynomial h1(x), and a polynomial h2(x); and an embedding degree k. An exponentiation computation unit (22) computes the hard part with using a power of a polynomial p(x)i for each integer i of i=0, . . . , d?1, a power of ?d?i(x) where ?d?i(x)=cd, a power of ?i where ?i=T(x)?i+1(x)+ci+1 for each integer i of i=0, . . . , d?2, a power of h1(x), a power of h2(x), multiplication, and inverse element computation.

Abstract: In a final exponentiation calculation device, a decomposition unit (221) decomposes an exponent part into an easy part and a hard part, using a cyclotomic polynomial, in a final exponentiation calculation part of a pairing operation on an elliptic curve represented by a polynomial r(u), a polynomial q(u), a polynomial t(u), an embedding degree k, and a parameter u. A transformation unit (222) transforms the hard part obtained by decomposition by the decomposition unit (221) into a linear sum of the polynomial q(u). An exponentiation calculation unit (23) calculates the final exponentiation calculation part, using the easy part and the hard part transformed into the linear sum of the polynomial q(u).