A scramble key generation unit generates scramble keys (individual encryption keys) which are different from one another and which are for encrypting and decrypting distributing data, by subjecting a predetermined initial encryption key at least once to a unidirectional reverse replacement and at least once to a trapdoor-equipped unidirectional replacement. A time key generation unit generates a time key (master encryption key) for regenerating the scramble keys, by subjecting any of the scramble keys generated by the scramble key generation unit at least once to the unidirectional reverse replacement. Thus, it is possible to efficiently and flexibly generate the individual encryption keys for encrypting and decrypting the distribution data, and master encryption key capable of regenerating some of the individual encryption keys.