Secret computation system, arithmetic unit, secret computation method and program

摘要

Each of at least three arithmetic units includes: a random number generator determining shared value [r] obtained by performing secret sharing of random number r; a randomizator using shared value [a₀], . . . , [a_M−1] obtained by performing secret sharing of value a₀, . . . , a_M−1 and shared value [r] to generate randomized shared value a₀, . . . , a_M−1 with shared values [a₀], . . . , [a_M−1] and [a₀r], . . . , [a_M−1r] as a pair; a secret computator determining concealed function value [F([a₀], . . . , [a_M−1])] by executing function F including at least one secret operation while including randomized shared value f_i of an operation target and an operation result depending on contents of secret operation into checksum C:=f₀, . . . , f_μ−1; and a correctness prover verifying correctness of function value [F([a₀], . . . , [a_M−1])] based on shared value [Ø] obtained by multiplying a sum total of shared values [f_i] included in checksum C by shared value [r] and shared value [ψ] of a sum total of shared values [f_ir] included in checksum C.