When data m is encrypted based on public key pk, a calculation equation used is c=(1+N)m·(hN mod N2)r mod N2, where random number r is used as an exponent of modular exponentiation. Therefore, the length of random number r needs to be controlled, to reduce modular exponentiation complexity. For example, when the length of N is n=2048 bits, it can be set that the length of random number r is i=320 bits, and therefore the length of α is also 320 bits. In addition, α=pq, and therefore the length of each of intermediate parameters p and q can be 160 bits, to ensure that the calculated length of α is 320 bits.