A secure shift system where P is a prime number, p is a number of bits of the prime number P, Q is an order of a factor ring, M is an upper limit value which can be taken by the MSB position of numerical values to be inputted, M' is an upper limit value of the MSB position which is allowable by shares, [R, R'] is a range of the right shift amount which is covered by a divided right shift, and [[x]] y and <<x>> y represent a share in which a mod y element x is performed by (k, n)-secret sharing and (k, n)-replicated secret sharing, respectively, where k is a threshold value of a secret sharing and n is a number of sharing of the secret sharing, the secure shift system which is configured of three or more secure shift apparatuses and computes a share [[s]] P of a numerical value s, where, s= 2 ρ a, obtained by shifting a numerical value a by p bits from a share [[a]] P of the numerical value a and a share <<ρ>> Q of the shift amount p, where, in a case of p ≥ 0, ρ represents the left shift, and in a case of p < 0, p represents the right shift, the secure shift system comprising: a modulus conversion means for computing a share <<ρ>> p from the <<ρ>> Q; a first flag computation means for computing shares [[f 0]] 2 = [[(ρ ≥ -R')]] 2, [[f 1]] 2 = [[(ρ ≥ -R'+u)]] 2,..., [[f d-1]] 2 = [[(ρ ≥ -R' + (d-1)u]] 2, and [[f L]] 2 = [[(ρ ≥ -R+1)]] 2 from the share <<ρ>> Q or the share <<ρ>> p, the range [R, R'], a numerical value u, and a numerical value d where u is an integer satisfying u ≤ M'-M+1 and d is an integer satisfying d ≥ ceiling(((R'-R+1)/u) Re), where (x/y) Re represents the value of real number division for two numbers x, y; a second flag computation means for computing shares <<f 1 >> p, <<f 2 >> p,..., <<f d-1 >> p, <<f L >> p from the shares [[f 1]] 2, [[f 2]] 2,..., [[f d-1]] 2, [[f L]] 2; a shift amount computation means for computing a share <<ρ'>> p = <<ρ>> p +R' -u (Σ 1≤i<d <<f i >> p) + ((d-1)u-R') <<f L >> p from the share <<ρ>> p, the shares <<f 1 >> p, <<f 2 >> p,..., <<f d-1 >> p, <<f L >> p, the upper limit value R' of the range, the numerical value u, and the numerical value d; a left shift means for computing a share [[b]] P = [[2 ρ' a]] P from the share [[a]] P and the share <<ρ'>> p; a right shift means for computing shares [[c 0]] P = [[2 ρ' a/2 R']] P, [[c 1]] P = [[2 ρ' a/ (2 R'-u)]] P,..., [c d-1]] P = [[2 ρ' a/(2 R'-(d-1)u)]] P from the share [[b]] P, the upper limit value R' of the range, the numerical value u, and the numerical value d; a third flag computation means for computing shares [[f 0]] P, [[f 1]] P,..., [[f d-1]] P, [[f L]] P from the shares [[f 0]] 2, [[f 1]] 2,..., [[f d-1] 2, [[f L]] 2; and a shift value computation means for computing the share [[s]] P = [[c 0]] P [[f 0]] P +([[c 1]] P - [[c 0]] P)[ [f 1]] P +... + ([[C d-1]] P - [[c d -2]] P)[ [f d-1]] P + ([[b]] P - [[c d-1]] P) [[f L]] P from the share [[b]] P, the shares [[c 0]] P, [[c 1]] P,..., [[c d-1]] P, and the shares [[f 0]] P, [[f 1]] P,..., [[f d-1]] P, [[f L]] P. a modulus conversion means for computing a share <<ρ>> p from the <<ρ>> Q; a first flag computation means for computing shares [[f 0]] 2 = [[(ρ ≥ -R')]] 2, [[f 1]] 2 = [[(ρ ≥ -R'+u)]] 2,..., [[f d-1]] 2 = [[(ρ ≥ -R' + (d-1)u]] 2, and [[f L]] 2 = [[(ρ ≥ -R+1)]] 2 from the share <<ρ>> Q or the share <<ρ>> p, the range [R, R'], a numerical value u, and a numerical value d where u is an integer satisfying u ≤ M'-M+1 and d is an integer satisfying d ≥ ceiling(((R'-R+1)/u) Re), where (x/y) Re represents the value of real number division for two numbers x, y; a second flag computation means for computing shares <<f 1 >> p, <<f 2 >> p,..., <<f d-1 >> p, <<f L >> p from the shares [[f 1]] 2, [[f 2]] 2,..., [[f d-1]] 2, [[f L]] 2; a shift amount computation means for computing a share <<ρ'>> p = <<ρ>> p +R' -u (Σ 1≤i<d <<f i >> p) + ((d-1)u-R') <<f L >> p from the share <<ρ>> p, the shares <<f 1 >> p, <<f 2 >> p,..., <<f d-1 >> p, <<f L >> p, the upper limit value R' of the range, the numerical value u, and the numerical value d; a left shift means for computing a share [[b]] P = [[2 ρ' a]] P from the share [[a]] P and the share <<ρ'>> p; a right shift means for computing shares [[c 0]] P = [[2 ρ' a/2 R']] P, [[c 1]] P = [[2 ρ' a/ (2 R'-u)]] P,..., [c d-1]] P = [[2 ρ' a/(2 R'-(d-1)u)]] P from the share [[b]] P, the upper limit value R' of the range, the numerical value u, and the numerical value d; a third flag computation means for computing shares [[f 0]] P, [[f 1]] P,..., [[f d-1]] P, [[f L]] P from the shares [[f 0]] 2, [[f 1]] 2,..., [[f d-1] 2, [[f L]] 2; and a shift value computation means for computing the share [[s]] P = [[c 0]] P [[f 0]] P +([[c 1]] P - [[c 0]] P)[ [f 1]] P +... + ([[C d-1]] P - [[c d -2]] P)[ [f d-1]] P + ([[b]] P - [[c d-1]] P) [[f L]] P from the share [[b]] P, the shares [[c 0]] P, [[c 1]] P,..., [[c d-1]] P, and the shares [[f 0]] P, [[f 1]] P,..., [[f d-1]] P, [[f L]] P.