A signature system includes a public key certificate obtainment device 100, a public key certificate issuance device 200, and a signature device 300. The public key certificate obtainment device 100 inputs item data and an infrastructure public key that includes an item key that is an element corresponding to each item of the item data and outputs both a public key certificate that includes item data and a secret key using the data that have been input and data supplied from the public key certificate issuance device. The public key certificate issuance device 200 inputs an infrastructure public key that includes the item key that is the element corresponding to each item of the item data and outputs a proof used to identify a signer using the data that have been input and the data supplied from the public key certificate obtainment device. The signature device 300 inputs a message, a revelation item set that represents items to be revealed, the secret key and the public key certificate that the public key certificate obtainment device 100 has output and outputs a selectively anonymous signature corresponding to the message and revelation item data that are item data that belong to the revelation item set using the data that have been input.