A key exchange technique of performing a key exchange among N (≥2) parties, which can conceal metadata on communication, is provided. A key exchange method includes: a first key generation step in which a communication device Ui generates a first key; a first anonymous broadcast step in which the communication device Ui anonymously broadcasts the first key with a set R-{Ui} being designated for i∈{1, . . . , n} and the communication device Ui anonymously broadcasts the first key with φ being designated for i∈{n+1, . . . , N}; a second key generation step in which the communication device Ui generates a second key; a second anonymous broadcast step in which the communication device Ui anonymously broadcasts the second key with the set R-{Ui} being designated for i∈{1, . . . , n} and the communication device Ui anonymously broadcasts the second key with φ being designated for i∈{n+1, . . . , N}; and a session key generation step in which the communication device Ui generates a session key SK for i∈{1, . . . , n} if a predetermined condition is satisfied.