A secure right shift computation system comprising m secure computation apparatuses, taking an input of a distributed value [a] of a value "a" and a shift amount "b," and calculating a distributed value [a>>b] of a value obtained by shifting the value "a" by "b" bits toward right, wherein [·] is a distributed value obtained by distributing a value "." by first secret sharing, <·> is a distributed value obtained by distributing the value "." by additive secret sharing, {-} is a distributed value obtained by distributing a bit expression of the value "·", the distributed value [·] and the distributed value <·> can be mutually converted, "a" is an arbitrary value, "b" is a shift amount, "m" is a distribution number of three or more, "u" is an integer of log m or more, "l" is a bit length of the value "a", and >> is a right shift operator, and wherein the secure computation apparatuses each include: a public value multiplication part that calculates a distributed value [a']=[2 u a] by using the distributed value [a]; a first conversion part that converts the distributed value [a'] into a distributed value <a'>=<a'> 0,..., <a'> m-1 of the additive secret sharing; a right shift computation part that, for each integer i of 0 or more and less than m, generates a distributed value 
=
 0,..., 
 m-1 by calculating 
 i =<a'> i >>b+u; a second conversion part that converts the distributed value 
 into a distributed value [s] of the first secret sharing; a first bit conversion part that converts lower u bits of a share <a'> i of the distributed value <a'> into a distributed value {a' i mod 2 u} of a bit expression for each integer i of 0 or more and less than m; a quotient transfer part that calculates lower u bits of -Σ i<m {a' i mod 2 u} to obtain as a distributed value {q} of a bit expression by using the distributed value {a' i mod 2 u}; a third conversion part that converts the distributed value {q} into a distributed value [q] of the first secret sharing; and an output computation part that calculates [s]-[2 l-(b+U) q]+1 to obtain as the distributed value [a>>b] by using the distributed values [s] and [q]. wherein [·] is a distributed value obtained by distributing a value "." by first secret sharing, <·> is a distributed value obtained by distributing the value "." by additive secret sharing, {-} is a distributed value obtained by distributing a bit expression of the value "·", the distributed value [·] and the distributed value <·> can be mutually converted, "a" is an arbitrary value, "b" is a shift amount, "m" is a distribution number of three or more, "u" is an integer of log m or more, "l" is a bit length of the value "a", and >> is a right shift operator, and wherein the secure computation apparatuses each include: a public value multiplication part that calculates a distributed value [a']=[2 u a] by using the distributed value [a]; a first conversion part that converts the distributed value [a'] into a distributed value <a'>=<a'> 0,..., <a'> m-1 of the additive secret sharing; a right shift computation part that, for each integer i of 0 or more and less than m, generates a distributed value 
=
 0,..., 
 m-1 by calculating 
 i =<a'> i >>b+u; a second conversion part that converts the distributed value 
 into a distributed value [s] of the first secret sharing; a first bit conversion part that converts lower u bits of a share <a'> i of the distributed value <a'> into a distributed value {a' i mod 2 u} of a bit expression for each integer i of 0 or more and less than m; a quotient transfer part that calculates lower u bits of -Σ i<m {a' i mod 2 u} to obtain as a distributed value {q} of a bit expression by using the distributed value {a' i mod 2 u}; a third conversion part that converts the distributed value {q} into a distributed value [q] of the first secret sharing; and an output computation part that calculates [s]-[2 l-(b+U) q]+1 to obtain as the distributed value [a>>b] by using the distributed values [s] and [q]. a public value multiplication part that calculates a distributed value [a']=[2 u a] by using the distributed value [a]; a first conversion part that converts the distributed value [a'] into a distributed value <a'>=<a'> 0,..., <a'> m-1 of the additive secret sharing; a right shift computation part that, for each integer i of 0 or more and less than m, generates a distributed value 
=
 0,..., 
 m-1 by calculating 
 i =<a'> i >>b+u; a second conversion part that converts the distributed value 
 into a distributed value [s] of the first secret sharing; a first bit conversion part that converts lower u bits of a share <a'> i of the distributed value <a'> into a distributed value {a' i mod 2 u} of a bit expression for each integer i of 0 or more and less than m; a quotient transfer part that calculates lower u bits of -Σ i<m {a' i mod 2 u} to obtain as a distributed value {q} of a bit expression by using the distributed value {a' i mod 2 u}; a third conversion part that converts the distributed value {q} into a distributed value [q] of the first secret sharing; and an output computation part that calculates [s]-[2 l-(b+U) q]+1 to obtain as the distributed value [a>>b] by using the distributed values [s] and [q].