A mask circuit (2) masks a bit sequence of K bits by a predetermined bit pattern. An EXOR circuit (3) EXORs the masked bit sequence. An inverter (9) controls inversion/non-inversion of values of bits of a bit sequence which includes a bit value indicating the EXOR result in a result obtained by shifting the bit sequence of K bits held in a shift register (1), in accordance with a designated bit value in a pattern table (14). A bit sequence as the control result is output as a random number expressed by K bits.