**Abbreviations**



#### **Appendix A. Numerical Example of the MPF SIP**

A numerical illustration of the MPF SIP is presented below for the matrices with dimensions 3 × 3. Firstly, PrK = ( *X*, *Y*) components are generated, where *X*,*Y* ← rand( *MNSR*). The entries of *X*, *Y* are chosen in the form {*t* + ι·*u* + *v*} as elements in *NSR* (see Proposition 4), where *t*, *u*, *v* are in *N***4 +** = {1, 2, 3, 4} according to Corollary 5.6. For convenience the imaginary unit ι in (17) is replaced by latin notation *i*.

$$X = \begin{bmatrix} 1+i+1 & 3+3i+3 & 1+3i+1 \\ 1+3i+1 & 1+i+1 & 3+3i+3 \\ 3+3i+3 & 1+3i+1 & 1+i+1 \end{bmatrix}$$

$$Y = \begin{bmatrix} 3+i+3 & 3+3i+1 & 1+i+3 \\ 1+i+3 & 3+i+3 & 3+3i+1 \\ 3+3i+1 & 1+i+3 & 3+i+3 \end{bmatrix}$$

Next, Public matrix *W* is generated at random ( *W* ← rand( *MS*)) and PuK = *A*= *XWY* is computed referencing to (4), (21)–(23), (32).

$$W = \begin{bmatrix} ba^3b^3a & ba^2ba & bab^3a \\ bab^3a & ba^2b^3a & bab^2a \\ bab^3a & bab^3a & ba^3b^3a \end{bmatrix}$$

$$A = \begin{bmatrix} ba^4 & ba^3b^2a & bab^2a \\ ba^3b^2a & ba^4 & ba^2 \\ ba^2 & bab^2a & ba^3b^2a \end{bmatrix}$$

Two matrices *U*, *V* are generated *U*,*V* ← rand(*MsNSR*) for the computation of **commitment**.

$$\mathcal{U} = \begin{bmatrix} 1+3i+3 & 3+i+3 & 3+3i+1 \\ 3+3i+1 & 1+3i+3 & 3+i+3 \\ 3+i+3 & 3+3i+1 & 1+3i+3 \end{bmatrix}$$

$$V = \begin{bmatrix} 3+i+1 & 3+3i+3 & 1+1i+3 \\ 1+1i+3 & 3+i+1 & 3+3i+3 \\ 3+3i+3 & 1+1i+3 & 3+i+1 \end{bmatrix}$$

⎤⎦

Then, according to (33), Prover computes the **commitment** *C* = (*C*0, *C*1, *C*2) consisting of three matrices *C*0, *C*1, *C*2 in *MS* and sends it to the Verifier.

$$\begin{aligned} \mathbf{C}\_{0} &= \begin{bmatrix} ba^{2} & ba^{3}b^{2}a & ba^{3}b^{2}a \\ ba^{2} & ba^{3}b^{2}a & ba^{3}b^{2}a \\ ba^{3}b^{2}a & ba^{2} & ba^{2} \end{bmatrix} \\\\ \mathbf{C}\_{1} &= \begin{bmatrix} ba^{4} & ba^{3}b^{2}a & bab^{2}a \\ ba^{4} & ba^{3}b^{2}a & bab^{2}a \\ ba^{2}a & ba^{2} & ba^{4} \end{bmatrix} \end{aligned}$$

$$\mathbf{C}\_{2} = \begin{bmatrix} ba^{2} & ba^{3}b^{2}a & ba^{3}b^{2}a \\ ba^{2}a & ba^{4} & ba^{4} \\ ba^{4} & ba^{2}a & bab^{2}a \end{bmatrix}$$

Verifier generates the **challenge** consisting of two matrices *H*,*H*" ← rand(*MsNSR*):

$$H' = \begin{bmatrix} 1+i+1 & 2+2i+2 & 3+3i+3\\ 3+3i+3 & 1+i+1 & 2+2i+2\\ 2+2i+2 & 3+3i+3 & 1+i+1 \end{bmatrix}$$

$$H'' = \begin{bmatrix} 4+4i+4 & 2+3i+4 & 1+2i+4\\ 1+2i+4 & 4+4i+4 & 2+3i+4\\ 2+3i+4 & 1+2i+4 & 4+4i+4 \end{bmatrix}$$

Upon receiving *H*,*H*" the Prover computes the response matrices *S*, *T* according to (34) where *S* = *U* + *HX*, *T* = *V* + *YH*". The entries of these matrices are the exponents of generators *a*, *b* in semigroup *S* and are presented in non-reduced form.

$$S = \mathcal{U} + H^\prime X = \begin{bmatrix} 1 + 59i + 67 & 1 + 45i + 51 & 1 + 47i + 55 \\ 1 + 47i + 55 & 1 + 59i + 67 & 1 + 45i + 51 \\ 1 + 45i + 51 & 1 + 47i + 55 & 1 + 59i + 67 \end{bmatrix}$$

$$T = \mathcal{V} + \mathcal{Y}H'' = \begin{bmatrix} 1 + 74i + 108 & 1 + 80i + 110 & 1 + 72i + 104 \\ 1 + 72i + 104 & 1 + 74i + 108 & 1 + 80i + 110 \\ 1 + 80i + 110 & 1 + 72i + 104 & 1 + 74i + 108 \end{bmatrix}$$

After reduction using relations *R*1, *R*2 in (11) the Prover computes the **response** *R* = (*S*, *T*) and sends it to the Verifier, where matrices *S*, *T* are expressed in the following way:

$$S = \mathcal{U} + H^\prime X = \begin{bmatrix} 1+3i+3 & 1+i+3 & 1+3i+3 \\ 1+3i+3 & 1+3i+3 & 1+i+3 \\ 1+i+3 & 1+3i+3 & 1+3i+3 \end{bmatrix}$$

$$T = \mathcal{V} + \mathcal{Y}H'' = \begin{bmatrix} 1+2i+4 & 1+4i+2 & 1+4i+4 \\ 1+4i+4 & 1+2i+4 & 1+4i+2 \\ 1+4i+2 & 1+4i+4 & 1+2i+4 \end{bmatrix}$$

Upon receiving *R* = (*S*, *T*), Verifier checks if the identity (35) holds:

$$\prescript{S}{}{W}^T = \mathbb{C}\_0 \prescript{H''}{}{H'} \prescript{H'}{}{\mathbb{C}}\_2 \prescript{H'}{}{A}^{H''} = \begin{bmatrix} ba^2ba & b^2a & b^4a \\ b^4a & ba^2b^3a & ba^2ba \\ b^2a & ba^2ba & ba^2b^3a \end{bmatrix}.$$

Since in this case the identity (35) is satisfied, the Verifier outputs **accept**.
