$$g^a = c \bmod{N} \text{ }\rightarrow \text{ }G_{i_1}G_{i_2}G_{i_3}...G_{i_n} = C \bmod N $$
At the Discrete Log problem we try to find the exponent ($a$) of a generator ($g$) over a finite filed. e.g. $$g^a = c \bmod{N}$$ We assume everything except the exponent is known. This also includes the factorization of $N, N-1, \phi(N) \phi(N-1)...$ and period length of $g$. We also know at least one solution for an exponent $a$ with given $c$ exists.
Now we extend this problem to a 2 factor problem: $$g_1^a \cdot g_2^b = c \bmod{N}$$ We choose $g_1,g_2,N$ carefully with being cycle with about the same length. $$\not\exists\text{ } a \text{ with: } g_1^a = g_2 \bmod N$$ This can be solved even easier (under the condition everything but $a,b$ is known). About $\sqrt{\text{security}}$ of the one generator case.
For integer multiplication the order of $g_1,g_2$ is irrelevant but
$\rightarrow$ Q: What happens if we change it to something where the order is relevant? Can we make the dlog problem significant harder?
e.g. a series of matrix multiplication: given 2 well chosen cyclic (with similar length) matrices $G_1$ and $G_2$ with (at least): $$\not\exists\text{ } a \text{ with: } G^a_1 = G_2 \bmod N$$ and a resulting matrix $C$ with $$G_{i_1}G_{i_2}G_{i_3}...G_{i_n} = C \bmod N$$ $$i_j \in [1,2]$$
As far as I know for 128-bit security for the one exponent DL-problem we use $N$ with a bit size of 3072 and $a$ with a bit size of 256.
To convert it to matrix multiplication the 256-bit key could mean $0 \rightarrow$ multiply with $G_1$ and $1 \rightarrow$ multiply with $G_2$. We will end up with a product of 256 matrices.
How difficult would it be to break this? We assume everything but the order in known. If it is less secure than the integer DL-problem are there alternative ways to make it more secure (e.g. increasing the amount of used matrices)?
Of course it hardly depends on the chosen matrices. We assume we picked matrices with most secure structure for a given matrix size. We can make it computable harder by just increasing their size. For size 1x1 we only get the two generator integer security of ~$64$-bit (if I'm not mistaken). What would be the minimal matrix size to reach $128$-bit security again?
As alternativ we could also use non-commutative hypercomplex numbers like Quaternions. I guess they gain less security than matrices. If both won't work out are there other non-commutative alternatives wich can be used to increase security?
