A method whereby an encryption apparatus encrypts a message on the basis of a fibration X(x, y, t) serving as a public key when private keys are two or more sections corresponding to fibration X(x, y, t)=0 of an algebraic surface X, the method comprises embedding plaintext M obtained by concatenating the message to a random number as the coefficients of plaintext polynomial M(t) of degree l−1 or less, and generating encrypted text F=Epk(M, p, q, f, X) from the plaintext polynomial M(t) by an encrypting process of performing operations including at least one of addition, subtraction, and multiplication of random polynomials p(x, y, t), q(x, y, t), a random irreducible polynomial f(t) of degree l or more, and the fibration X(x, y, t) with respect to the plaintext polynomial M(t).