SECURE SHIFT SYSTEM, SECURE SHIFT APPARATUS, SECURE SHIFT METHOD, AND PROGRAM

1 . A secure shift system where P is a prime number, p is a number of bits of the prime number P, Q is an order of a factor ring, M is an upper limit value which can be taken by the MSB position of numerical values to be inputted, M′ is an upper limit value of the MSB position which is allowable by shares, and [R, R′] is a range of the right shift amount which is covered by the divided right shift, the secure shift system which is configured of three or more secure shift apparatuses and computes a share ((s)) P of a numerical value s (where, s=2 ρ a) obtained by shifting a numerical value a by ρ bits from a share ((a)) P of the numerical value a and a share <<ρ>> Q of the shift amount ρ (where, in a case of ρ≥0, ρ represents the left shift, and in a case of ρ<0, ρ represents the right shift), the secure shift system comprising:

modulus conversion circuitry configured to compute a share <<ρ>> p from the <<ρ>> Q ;

first flag computation circuitry configured to compute shares ((f 0 )) 2 =(((ρ≥−R′))) 2 , ((f 1 )) 2 =(((ρ≥−R′+u))) 2 , . . . , ((f d-1 )) 2 =(((ρ≥−R′+(d−1)u)) 2 , and ((f L )) 2 =(((ρ≥−R+1))) 2 from the share <<ρ>> Q or the share <<ρ>> p , the range [R, R′], a numerical value u, and a numerical value d where u is an integer satisfying u≤M′−M+1 and d is an integer satisfying d≥ceiling(((R′−R+1)/u) Re );

a second flag circuitry configured to compute shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p from the shares ((f 1 )) 2 , ((f 2 )) 2 , . . . , ((f d-1 )) 2 , ((f L )) 2 ;

shift amount computation circuitry configured to compute a share <<ρ′>> p =<<ρ>> p +R′−u(Σ 1≤i<d <<f i >> p )+((d−1)u−R)<<f L >> p from the share <<ρ>> p , the shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

left shift circuitry configured to compute means a share ((b)) P =((2 ρ′ a)) P from the share ((a)) P and the share <<ρ′>> p ;

right shift circuitry configured to compute shares ((c 0 )) P =((2 ρ′ a/2 R′ )) P , ((c 1 )) P =((2 ρ′ a/(2 R′-u ))) P , . . . , ((c d-1 )) P =(2 ρ′ a/(2 R′-(d-1)u ))) P from the share ((b)) P , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

third flag computation circuitry configured to compute shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L )) P from the shares ((f 0 )) 2 , ((f 1 )) 2 , . . . , ((f d-1 )) 2 , ((f L ) 2 ; and

shift value computation circuitry configured to compute the share ((s)) P =((c 0 )) P ((f 0 )) P +(((c 1 )) P −((c 0 )) P )((f 1 )) P + . . . +(((c d-1 )) P −((c d-2 )) P )((f d-1 )) P +(((b)) P −((c d-1 )) P ((f L )) P from the share ((b)) P , the shares ((c 0 )) P , ((c 1 )) P , . . . , ((c d-1 )) P , and the shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L ) P .

2 . A secure shift apparatus in a secure shift system where P is a prime number, p is a number of bits of the prime number P, Q is an order of a factor ring, M is an upper limit value which can be taken by the MSB position of numerical values to be inputted, M′ is an upper limit value of the MSB position which is allowable by shares, and [R, R′] is a range of the right shift amount which is covered by the divided right shift, the secure shift system which is configured of three or more secure shift apparatuses and computes a share ((s)) P of a numerical value s (where, s=2 ρ a) obtained by shifting a numerical value a by ρ bits from a share ((a)) P of the numerical value a and a share <<ρ>> Q of the shift amount ρ (where, in a case of ρ≥0, ρ represents the left shift, and in a case of ρ<0, ρ represents the right shift), the secure shift apparatus comprising:

modulus conversion circuitry configured to compute a share <<ρ>> p from the <<ρ>> Q ;

first flag computation circuitry configured to compute shares ((f 0 )) 2 =(((ρ≥−R′))) 2 , ((f 1 )) 2 =(((ρ≥−R′+u))) 2 , . . . , ((f d-1 )) 2 =(((ρ≥−R′+(d−1)u)) 2 , and ((f L ) 2 =(((ρ≥−R+1))) 2 from the share <<ρ>> Q or the share <<ρ>> p , the range [R, R′], a numerical value u, and a numerical value d where u is an integer satisfying u≤M′−M+1 and d is an integer satisfying d>ceiling(((R′−R+1)/u) Re );

second flag computation circuitry configured to compute shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p from the shares ((f 1 )) 2 , ((f 2 )) 2 , . . . , ((f d-1 )) 2 , ((f L )) 2 ;

shift amount computation circuitry configured to compute a share <<ρ′>> p =<<ρ>> p +R′−u(Σ 1≤i<d <<f i >> p )+((d−1)u−R′)<<f L >> p from the share <<ρ>> p , the shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

left shift circuitry configured to compute a share ((b)) P =((2 ρ′ a)) P from the share ((a)) P and the share <<ρ′>> p ;

a right shift circuitry configured to compute shares ((2 ρ′ a/2 R′ )) P , ((c 1 )) P =((2 ρ′ a/(2 R′-u ))) P , . . . , ((c d-1 )) P =((2 ρ′ a/(2 R′-(d-1)u ))) P from the share ((b)) P , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

third flag computation circuitry configured to compute shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L )) P from the shares ((f 0 )) 2 , ((f 1 )) 2 , . . . , ((f d-1 )) 2 , ((f L )) 2 ; and

a shift value computation circuitry configured to compute the share ((s)) P =((c 0 )) P ((f 0 )) P +(((c 1 )) P −((c 0 )) P )((f 1 )) P + . . . +(((c d-1 )) P −((c d-2 )) P )((f d-1 ))+(((b)) P −((c d-1 )) P )((f L )) P from the share ((b)) P , the shares ((c 0 )) P , ((c 1 )) P , . . . , ((c d-1 )) P , and the shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L )) P .

3 . A secure shift method where P is a prime number, p is a number of bits of the prime number P, Q is an order of a factor ring, M is an upper limit value which can be taken by the MSB position of numerical values to be inputted, M′ is an upper limit value of the MSB position which is allowable by shares, and [R, R′] is a range of the right shift amount which is covered by the divided right shift, the secure shift method by which a share ((s)) P of a numerical value s (where, s=2 ρ a) obtained by shifting a numerical value a by ρ bits is computed from a share ((a)) P of the numerical value a and a share <<ρ>> Q of the shift amount ρ (where, in a case of ρ>0, ρ represents the left shift, and in a case of ρ<0, ρ represents the right shift) by using a secure shift system configured of three or more secure shift apparatuses, the secure shift method comprising:

a modulus conversion step in which the secure shift system computes a share <<ρ>> p from the <<ρ>> Q ;

a first flag computation step in which the secure shift system computes shares ((f 0 )) 2 =(((ρ≥−R′))) 2 , ((f 1 )) 2 =(((ρ≥−R′+u))) 2 , . . . , ((f d-1 )) 2 =(((ρ≥−R′+(d−1)u)) 2 , and ((f L )) 2 =(((ρ≥−R+1))) 2 from the share <<ρ>> Q or the share <<ρ>> p , the range [R, R′], a numerical value u, and a numerical value d where u is an integer satisfying u≤M′−M+1 and d is an integer satisfying d>ceiling(((R′−R+1)/u) Re );

a second flag computation step in which the secure shift system computes shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p from the shares ((f 1 )) 2 , ((f 2 )) 2 , . . . , ((f d-1 )) 2 , ((f L )) 2 ;

a shift amount computation step in which the secure shift system computes share <<ρ′>> p =<<ρ>> p ±R′-u(Σ 1≤i<d <<f i >> p )+((d−1)u−R′)<<f L >> p from the share <<ρ>> p , the shares <<f 1 >> p , <<f 2 >> p , . . . , <<f d-1 >> p , <<f L >> p , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

a left shift step in which the secure shift system computes a share ((b)) P =((2 ρ′ a)) P from the share ((a)) P and the share <<ρ′>> p ;

a right shift step in which the secure shift system computes shares ((c 0 )) P =((2 ρ′ a/2 R′ )) P , ((c 1 )) P =((2 ρ′ a/(2 R′-u ))) P , . . . , ((c d-1 )) P =(2 ρ′ a/(2 R′- (d-1)u ))) P from the share ((b)) P , the upper limit value R′ of the range, the numerical value u, and the numerical value d;

a third flag computation step in which the secure shift system computes shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L )) P from the shares ((f 0 )) 2 , ((f 1 )) 2 , . . . , ((f d-1 )) 2 , ((f L )) 2 ; and

a shift value computation step in which the secure shift system computes the share ((s)) P =((c 0 )) P ((f 0 )) P +(((c 1 ) P −((c 0 )) P )((f 1 ) P + . . . +(((c d-1 ) P −((c d-2 )) P )((f d-1 ) P +(((b)) P −((c d-1 ) P )((f L )) P from the share ((b)) P , the shares ((c 0 )) P , ((c 1 )) P , . . . , ((c d-1 )) P , and the shares ((f 0 )) P , ((f 1 )) P , . . . , ((f d-1 )) P , ((f L )) P .

4 . A secure shift system where P is a prime number, p is a number of bits of the prime number P, and M is an upper limit value of the shift amount, the secure shift system which is configured of three or more secure shift apparatuses and computes a share ((s)) P of a numerical value s (where, s=a/2 ρ ) obtained by shifting a numerical value a to the right by ρ bits from a share ((a)) P of the numerical value a and a share <<ρ>> p of the shift amount ρ (0≤ρ≤M is satisfied, and a numerical value 2 M a obtained by shifting the numerical value a to the left by M bits does not overflow), the secure shift system comprising:

shift amount computation circuitry configured to compute a share <<M−ρ>> p from the share <<ρ>> p and the upper limit value M;

left shift circuitry configured to compute a share ((b)) P =((2 M-ρ a)) P from the share ((a)) P and the share <<M−ρ>> p ; and

right shift circuitry configured to compute the share ((s)) P =((2 M-ρ a/2 M )) P from the share ((b)) P and the upper limit value M.

5 . A secure shift system where P is a prime number, p is a number of bits of the prime number P, Q is an order of a factor ring, and M is an upper limit value that can be taken by the MSB position of numerical values to be inputted, the secure shift system which is configured of three or more secure shift apparatuses and computes a share ((s)) P of a numerical value s (where, s=2 Pa) obtained by shifting a numerical value a by ρ bits from a share ((a)) P of the numerical value a and a share <<ρ>> Q of the shift amount ρ (where, in a case of ρ≥0, ρ represents the left shift, and in a case of ρ<0, ρ represents the right shift), the secure shift system comprising:

modulus conversion circuitry configured to compute a share <<ρ>> p from the share <<ρ>> Q ;

a first flag computation circuitry configured to compute a share ((f L )) 2 =(((ρ≥0))) 2 from the share <<ρ>> Q or the share <<ρ>> p ;

second flag computation circuitry configured to compute a share <<f L >> p from the share ((f L )) 2 ;

a shift amount computation circuitry configured to compute a share <<ρ′>> p =<<ρ>> p +M−M<<f L >> p from the share <<ρ>> Q , the share <<f L >> p , and the upper limit value M;

left shift computation circuitry configured to compute a share ((b)) P =((2 ρ′ a)) P from the share ((a)) P and the share <<ρ′>> p ;

right shift circuitry configured to compute a share ((c)) P =((2 ρ′ a/2 M )) P from the share ((b)) P and the upper limit value M;

third flag computation circuitry configured to compute a share ((f L )) P from the share ((f L )) 2 ; and

shift value computation circuitry configured to compute the share ((s)) P =((c)) P +(((b)) P −((c)) P )((f L )) P from the share ((b)) P , the share ((c)) P , and the share ((f L )) P .

6 . A non-transitory computer-readable recording medium storing a program for causing a computer to function as the secure shift apparatus according to claim 2 .

7 . A non-transitory computer-readable recording medium storing a program for causing a computer to perform the secure shift method of claim 3 .