Abstract: In a cryptosystem, communication terminals and encryptors can be grouped physically and logically. The communication mode can be switched by the encryptor between ciphertext communication and plaintext communication. The encryptor includes the session key memorizing unit for memorizing the session key and the mode switch for switching the communication mode between ciphertext communication and plaintext communication. The key manager distributes the session key generated by the session key generating unit and the valid/invalid information set by the valid/invalid setting unit to each encryptor. The valid/invalid judging unit judges whether the communication data should be sent in ciphertext or plaintext using the mode switch and the valid/invalid information.