A sender sends original random-number data to a receiver through a quantum channel. The receiver generates a raw key from information received through the quantum channel and notifies the received information to the sender. The sender performs received-bit comparison and basis reconciliation based on the received information and provisionally shares a sifted key with the receiver. The receiver sends part of its version of the sifted key to the sender, by which an error rate is calculated. The calculated error rate is compared with a predetermined threshold value for bit position synchronization determination. When the calculated error rate is larger, the sender notifies the receiver that bit position synchronization is not established. The receiver reassigns bit numbers to the sifted key, and received-bit comparison and basis reconciliation are performed again. This procedure is repeated until the calculated error rate becomes smaller than the threshold value.