An inconsistency in shares is detected with a small volume of communications traffic. n inconsistency detecting devices generate random numbers si and make the random numbers si public. The n inconsistency detecting devices generate a common random number s which is the sum total of the random numbers s0, . . . , sn−1. The n inconsistency detecting devices calculate shares [c]i. The n inconsistency detecting devices generate shares [r]i, each of which would become a random number r by reconstruction. The n inconsistency detecting devices calculate shares [d]i, each of which would become a judgment value d by reconstruction. One inconsistency detecting device receives shares [d]1, . . . , [d]n−1 from n−1 inconsistency detecting devices. The one inconsistency detecting device restores n−k shares [d]′k, . . . , [d]′n−1 from k shares [d]0, . . . , [d]k−1. The one inconsistency detecting device judges, for j=k, . . . , n−1, whether or not a share [d]j and a share [d]′j coincide with each other.