A secret sharing system comprising a data distribution apparatus and N distributed data transform apparatuses, the data distribution apparatus comprising: a key selecting part selecting K'-1 keys s 1,..., s K'-1 ∈ S; a pseudorandom number generation part computing r j = P(s j) from the keys s 1,..., s K'-1 to generate pseudorandom numbers r 1,..., r K'-1, where j = 1,..., K'-1; an encryption part generating a ciphertext c by subtracting the sum of the pseudorandom numbers r 1,..., r K'-1 from information a ∈ R; a key division part dividing each of the keys s 1,..., s K'-1 into N shares f s1 (n),..., f sK'-1 (n) by using an arbitrary secret sharing scheme S1; and a ciphertext division part dividing the ciphertext c into N shares f c (n) by using an arbitrary sharing scheme S0; each of the distributed data transform apparatus comprising: a reconstruction part computing a reconstructed value U j = P(u j) from a value u j generated by reconstruction of shares f sj (i) by using the secret sharing scheme S1 when K shares f sj (i) are input into the distributed data transform apparatuses, and generating the reconstructed value U j (j = K') by reconstruction of shares f c (i) by using the secret sharing scheme S0 when K shares f c (i) are input into the distributed data transform apparatuses; a redivision part dividing the reconstructed value U j into N shares f Uj (n) by using an arbitrary homomorphic secret sharing scheme S2; and a transform part generating a share g a (i) of the information a by calculating the sum of K' shares f U1 (i),..., f UK' (i); where N, K and K' are integers greater than or equal to 2, N ≥ K, n = 1,..., N, λ represents K different integers greater than or equal to 1 and less than or equal to N, i is an integer, i ∈ λ, f x (n) represents N shares of x, R is a ring, S is a key space, and P(x) is a mapping that maps x ∈ S to the ring R. a key selecting part selecting K'-1 keys s 1,..., s K'-1 ∈ S; a pseudorandom number generation part computing r j = P(s j) from the keys s 1,..., s K'-1 to generate pseudorandom numbers r 1,..., r K'-1, where j = 1,..., K'-1; an encryption part generating a ciphertext c by subtracting the sum of the pseudorandom numbers r 1,..., r K'-1 from information a ∈ R; a key division part dividing each of the keys s 1,..., s K'-1 into N shares f s1 (n),..., f sK'-1 (n) by using an arbitrary secret sharing scheme S1; and a ciphertext division part dividing the ciphertext c into N shares f c (n) by using an arbitrary sharing scheme S0; each of the distributed data transform apparatus comprising: a reconstruction part computing a reconstructed value U j = P(u j) from a value u j generated by reconstruction of shares f sj (i) by using the secret sharing scheme S1 when K shares f sj (i) are input into the distributed data transform apparatuses, and generating the reconstructed value U j (j = K') by reconstruction of shares f c (i) by using the secret sharing scheme S0 when K shares f c (i) are input into the distributed data transform apparatuses; a redivision part dividing the reconstructed value U j into N shares f Uj (n) by using an arbitrary homomorphic secret sharing scheme S2; and a transform part generating a share g a (i) of the information a by calculating the sum of K' shares f U1 (i),..., f UK' (i); where N, K and K' are integers greater than or equal to 2, N ≥ K, n = 1,..., N, λ represents K different integers greater than or equal to 1 and less than or equal to N, i is an integer, i ∈ λ, f x (n) represents N shares of x, R is a ring, S is a key space, and P(x) is a mapping that maps x ∈ S to the ring R. a reconstruction part computing a reconstructed value U j = P(u j) from a value u j generated by reconstruction of shares f sj (i) by using the secret sharing scheme S1 when K shares f sj (i) are input into the distributed data transform apparatuses, and generating the reconstructed value U j (j = K') by reconstruction of shares f c (i) by using the secret sharing scheme S0 when K shares f c (i) are input into the distributed data transform apparatuses; a redivision part dividing the reconstructed value U j into N shares f Uj (n) by using an arbitrary homomorphic secret sharing scheme S2; and a transform part generating a share g a (i) of the information a by calculating the sum of K' shares f U1 (i),..., f UK' (i); where N, K and K' are integers greater than or equal to 2, N ≥ K, n = 1,..., N, λ represents K different integers greater than or equal to 1 and less than or equal to N, i is an integer, i ∈ λ, f x (n) represents N shares of x, R is a ring, S is a key space, and P(x) is a mapping that maps x ∈ S to the ring R.