A 4-byte LBA (logical block address) specified in a read command is supplied to first and second IV (initialization vector) generation units. The initialization-vector generation units each extend the LBA to data with a size of 16 bytes by applying typically a hash function to the LBA. The first initialization-vector generation unit outputs the data with a size of 16 bytes to an encryption unit as an initialization vector IV. On the other hand, the second initialization-vector generation unit outputs the data with a size of 16 bytes to a decryption unit as an initialization vector IV. The encryption unit encrypts input data by using the initialization vector IV and a session key Ks received from a first authentication-processing unit. On the other hand, the decryption unit decrypts input data by using the initialization vector IV and the session key Ks received from a second authentication-processing unit.