Patent ID: 10950144

Abstract:
Falsification is detected during secret computation that uses a plurality of types of secret sharing. A secret computation apparatus 1 uses shared values [a0], . . . , [aM-1] as inputs, and a function value [F([a0], . . . , [aM-1])] obtained with a function F for performing secret computation that uses J types of secret sharing as an output, and detects falsification during secret computation. A random number generating section 12 obtains shared values [r0], . . . , [rJ-1]. A randomizing section 13 multiplies the shared value [am] by the shared value [rj] to calculate a shared value [amrj], and generates a randomized shared value <am>:=<[am], [amrj]>. A secret computation section 14 obtains the function value [F([a0], . . . , [aM-1])] while including, in a checksum Cj, randomized shared values that are computation objects and randomized shared values that are computation results. A synchronizing section 15 keeps idling until all of secret computation that uses secret sharing are completed. A validating section 16 verifies that the shared value [φj] obtained by multiplying the sum of shared values [f0], . . . , [fμj-1] included in the checksum Cj by the shared value [rj] is equal to the shared value [ψj] obtained by adding shared values [f0rj], . . . , [fμj-1rj] included in the checksum Cj.