This cryptographic apparatus executes calculations according to an FI function including a first non-linear function S9 and a second non-linear function S7, and includes a ROM recording a first table including, for each input X of 9 bits, a value obtained by exclusively ORing a first value and an first output from the function S9 with respect to the input X, wherein the first value is generated by shifting lower 7 bits in the first output to left by 9 bits, and a second table including, for each input Y of 7 bits, a value obtained by exclusively ORing a second value and the input Y, wherein the second value is generated by shifting a result of an exclusive OR of the input Y and a second output from the function S7 with respect to the input Y to left by 9 bits.