A secure cross tabulation system comprising: a plurality of secure computation apparatuses (1 1,..., 1 N), wherein m is an integer equal to or greater than 2; [e]:= [e 0],..., [e m-1] is a share obtained by secret sharing of a flag e:= e 0,..., e m-1 in which last elements of each group are true and other elements are false when a table formed of a key attribute and a value attribute is grouped based on a value of the key attribute; {{σ}} is a share obtained by secret sharing of a permutation σ which moves elements such that the last elements of each group are sequentially arranged from beginning when the table is grouped based on the value of the key attribute; and g is a maximum number of such groups, and each of the secure computation apparatuses includes a boundary number setting unit that generates a share [x] that becomes a vector x:= x 0,..., x m-1 when reconstructed, using the share [e], by setting [x i]:= [i+1] when [ei] is true and setting [x i]:= [m] when [ei] is false for each integer i greater than or equal to 0 and smaller than or equal to m-1, a sorting unit that generates a share [σ(x)] that becomes a sorted vector σ(x) which is the vector x as sorted by the permutation σ when reconstructed, using the share [x] and the share {{σ}}, and a count calculation unit that generates a share [c] that becomes a vector c:= c 0,..., c min(g,m)-1 representing the number of records in each group when reconstructed, using the share [σ(x)], by setting [c i]:= [σ(x) i -σ(x) i-1] for each integer i greater than or equal to 1 and smaller than or equal to min(g,m)-1 and setting [c 0]:= [σ(x) 0]. a plurality of secure computation apparatuses (1 1,..., 1 N), wherein m is an integer equal to or greater than 2; [e]:= [e 0],..., [e m-1] is a share obtained by secret sharing of a flag e:= e 0,..., e m-1 in which last elements of each group are true and other elements are false when a table formed of a key attribute and a value attribute is grouped based on a value of the key attribute; {{σ}} is a share obtained by secret sharing of a permutation σ which moves elements such that the last elements of each group are sequentially arranged from beginning when the table is grouped based on the value of the key attribute; and g is a maximum number of such groups, and each of the secure computation apparatuses includes a boundary number setting unit that generates a share [x] that becomes a vector x:= x 0,..., x m-1 when reconstructed, using the share [e], by setting [x i]:= [i+1] when [ei] is true and setting [x i]:= [m] when [ei] is false for each integer i greater than or equal to 0 and smaller than or equal to m-1, a sorting unit that generates a share [σ(x)] that becomes a sorted vector σ(x) which is the vector x as sorted by the permutation σ when reconstructed, using the share [x] and the share {{σ}}, and a count calculation unit that generates a share [c] that becomes a vector c:= c 0,..., c min(g,m)-1 representing the number of records in each group when reconstructed, using the share [σ(x)], by setting [c i]:= [σ(x) i -σ(x) i-1] for each integer i greater than or equal to 1 and smaller than or equal to min(g,m)-1 and setting [c 0]:= [σ(x) 0]. a boundary number setting unit that generates a share [x] that becomes a vector x:= x 0,..., x m-1 when reconstructed, using the share [e], by setting [x i]:= [i+1] when [ei] is true and setting [x i]:= [m] when [ei] is false for each integer i greater than or equal to 0 and smaller than or equal to m-1, a sorting unit that generates a share [σ(x)] that becomes a sorted vector σ(x) which is the vector x as sorted by the permutation σ when reconstructed, using the share [x] and the share {{σ}}, and a count calculation unit that generates a share [c] that becomes a vector c:= c 0,..., c min(g,m)-1 representing the number of records in each group when reconstructed, using the share [σ(x)], by setting [c i]:= [σ(x) i -σ(x) i-1] for each integer i greater than or equal to 1 and smaller than or equal to min(g,m)-1 and setting [c 0]:= [σ(x) 0].