Abstract: A function f(x) is calculated with a calculating apparatus that makes a correct calculation with a low probability. Provided that G and H are cyclic groups, f is a function that maps an element x of the group H into the group G, X1 and X2 are random variables whose values are elements of the group G, x1 is a realized value of the random variable X1, and x2 is a realized value of the random variable X2, an integer calculation part calculates integers a? and b? that satisfy a relation a?a+b?b=1 using two natural numbers a and b that are relatively prime. A first randomizable sampler is capable of calculating f(x)bx1 and designates the calculation result as u. A first exponentiation part calculates u?=ua. A second randomizable sampler is capable of calculating f(x)ax2 and designates the calculation result as v. A second exponentiation part calculates v?=vb. A determining part determines whether u?=v? or not. A final calculation part calculates ub?va? in a case where it is determined that u?=v?.

Abstract: An information output apparatus identifies, according to a rule established for each of functional encryption protocols or a rule established for each combination of the protocols, one or more identifiers corresponding to a particular functional encryption protocol or a combination of the particular protocols, sets a particular piece of first correspondence information corresponding to the identifier or identifiers, and outputs first information which is a ciphertext or key information of the functional encryption scheme that corresponds to the particular piece of first correspondence information.

Abstract: A calculation ?i=0N?1e(R(i, 0), . . . , R(i, K?1)) where a calculation of K elements R(i, k)?GF(pm) of a finite field GF(pm) over a finite field is expressed as e(R(i, 0), . . . , R(i, K?1)) is efficiently performed. Polynomials poly(R(i, 0), . . . , R(i, K?1)) that express a d-th-order extension field of the finite field GF(pm), which are obtained by the calculations e(R(i, 0), . . . , R(i, K?1)) for different values of i, are multiplied by each other, and a cumulative multiplication of the products is performed, for example. The polynomial poly(R(i, 0), . . . , R(i, K?1)) is a mapping from the input elements of the finite field GF(pm), and the coefficients of at least some of the terms thereof are 0. The same process is performed for different sets of values of i, and the calculation ?i=0N?1e(R(i, 0), . . . , R(i, K?1)) is performed using the result.

Abstract: A cryptographic communication technology that is based on predicate encryption and that can operate flexibly is provided. A conversion rule information pair is determined in advance, which has attribute conversion rule information prescribing a conversion rule for converting attribute designation information to attribute information used in a predicate encryption algorithm and predicate conversion rule information prescribing a conversion rule for converting predicate designation information to predicate information used in the predicate encryption algorithm. One kind of conversion rule information included in the conversion rule information pair is used to obtain first attribute information or first predicate information from input information. The first attribute information or the first predicate information is used for encryption.

Abstract: Values X and N of n bits and a parameter t are input, then Y=X2?t mod N is calculated, then an extended binary GCD algorithm is executed for Y to obtain S=y?12k mod N and k, and R=S2?(k+t=2n) is calculated for S, thereby obtaining a Montgomery inverse R=X?122n mod N of X on a residue class ring Z/NZ.

Abstract: Values X and N of n bits and a parameter t are input, then Y=X2?t mod N is calculated, then an extended binary GCD algorithm is executed for Y to obtain S=[[Y]] y?12k mod N and k, and R=S2?(k+t=2n) is calculated for S, thereby obtaining a Montgomery inverse R=X?122n mod N of X on a residue class ring Z/NZ.

Abstract: Values X and N of n bits and a parameter t are input, then Y=X2−t mod N is calculated, then an extended binary GCD algorithm is executed for Y to obtain S=y−12k mod N and k, and R=S2−(k+t−2n) is calculated for S, thereby obtaining a Montgomery inverse R=X−I22n mod N of X on a residue class ring Z/NZ.

Abstract: In an apparatus for calculating m-multiplication of a rational point over an elliptic curve defined over a finite field, a base-&phgr; expansion part calculates c0, c1, . . .