A share generating device obtains N seeds s0, . . . , sN−1, obtains a function value y=g(x, e)∈Fm of plaintext x∈Fm and a function value e, and obtains information containing a member yi and N−1 seeds sd, where d∈{0, . . . , N−1} and d≠i, as a share SSi of the plaintext x in secret sharing and outputs the share SSi. It is to be noted that the function value y is expressed by members y0∈Fm(0), . . . , yN−1∈Fm(N−1) which satisfy m=m(0)+ . . . +m(N−1).