An encrypted image C(i, j) is generated by exclusively ORing pseudo random number values, which are generated using a key k.sub.0 as a key, and respective bits, except for the LSBs, of B pixel data at respective pixel positions (i, j) of digital image data I(i, j). First check bits B(i, j) corresponding to the pixel positions of pixels are generated based on the image C(i, j) and a conversion table. A digitally watermarked image I'(i, j) is obtained by embedding the first check bits in the LSBs of the corresponding pixel data of the digital image data. Check bits U(i, j) are obtained by encrypting pixel data by exclusively ORing respective bits, except for the LSBs, of B pixel data at positions (i, j) of the image I'(i, j) and the pseudo random numbers. If each check bit U(i, j) matches the LSB of the corresponding B pixel data, it is determined that the corresponding pixel is free from tampering.