An encryption method of a terminal device, the encryption method comprising: setting a ring which is a set including elements between which addition and multiplication are defined, the ring including a plaintext space that is a real number from among sets that are closed to addition and multiplication; calculating a secret key from the ring; calculating a public key corresponding to the calculated secret key; the method characterised by : calculating an error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution; and generating a homomorphic ciphertext by applying the public key to a message, the generating the homomorphic ciphertext comprises: multiplying the message by a scaling factor and adding the error to the multiplied message, and performing encryption using the public key to generate the homomorphic ciphertext, wherein the homomorphic ciphertext is in a form that a result value obtained by adding the error to a value obtained by reflecting the scaling factor in the message, wherein a modulus of the homomorphic ciphertext is set as an exponentiation of one scaling factor. setting a ring which is a set including elements between which addition and multiplication are defined, the ring including a plaintext space that is a real number from among sets that are closed to addition and multiplication; calculating a secret key from the ring; calculating a public key corresponding to the calculated secret key; the method characterised by : calculating an error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution; and generating a homomorphic ciphertext by applying the public key to a message, the generating the homomorphic ciphertext comprises: multiplying the message by a scaling factor and adding the error to the multiplied message, and performing encryption using the public key to generate the homomorphic ciphertext, wherein the homomorphic ciphertext is in a form that a result value obtained by adding the error to a value obtained by reflecting the scaling factor in the message, wherein a modulus of the homomorphic ciphertext is set as an exponentiation of one scaling factor. calculating an error from a discrete Gaussian distribution or a distribution that is within a short statistical distance to the discrete Gaussian distribution; and generating a homomorphic ciphertext by applying the public key to a message, the generating the homomorphic ciphertext comprises: multiplying the message by a scaling factor and adding the error to the multiplied message, and performing encryption using the public key to generate the homomorphic ciphertext, wherein the homomorphic ciphertext is in a form that a result value obtained by adding the error to a value obtained by reflecting the scaling factor in the message, wherein a modulus of the homomorphic ciphertext is set as an exponentiation of one scaling factor. multiplying the message by a scaling factor and adding the error to the multiplied message, and performing encryption using the public key to generate the homomorphic ciphertext, wherein the homomorphic ciphertext is in a form that a result value obtained by adding the error to a value obtained by reflecting the scaling factor in the message, wherein a modulus of the homomorphic ciphertext is set as an exponentiation of one scaling factor. <EOS>