An RSA signature method is provided in which the length of a signature does not depend on the number of signature devices when multiple signature devices are related to the creation of the signature. A signature device i_{m} includes first conversion means SS1B105 that performs no operation if a received signed text u_{i_{m−1}} exceeds a modulus n_{i_{m}} and, if not, adds an RSA-method-based signature; bijective conversion means S1B106 that multiplies the result by a function that maps the result to a value larger by the modulus n_{i_{m}}; second conversion means S1B107 that performs no operation if the operation result exceeds the modulus n_{i_{m}} and, if not, adds an RSA-method-based signature; and output means S1B109 that outputs the operation result as the signed text u_{i_{m}}.