Abstract: According to embodiments of the present invention, in a case where a ground for security is laid in difficulty in executing an inverse function operation of a trapdoor one-way function, represented by an RSA problem, even when a signature order advances, an increase of a size of a key can be inhibited. For example, when the first partial data ?i-1,L exceeding (k0+k1) bits when concatenating a random number ri of k0 bits is excluded from an input of binary operation on an input side of a signature generation function. Accordingly, a size of an operation result si of the binary operation is set to be constant at (k0+k2) bits, and, as a result, an input size (key length k bits) of an RSA signature generation function is set to be constant.

Abstract: According to each embodiment of the present invention, random function operations less than three times and tight security can simultaneously be implemented. More specifically, a ciphertext y=c?t or a signature ?=c??t is created as concatenated data of two data. The concatenated data is created by using a public key encryption scheme for only one (necessary part s) of the data. For this reason, tight security for the one-way characteristic of a trapdoor one-way function of the public key encryption scheme can be implemented. In addition, the output size of a first random function H? is limited. Accordingly, a random function G for bit expansion in the conventional. OAEP++-ES scheme can be omitted. Hence, the number of times of use of random functions can be reduced to two.