Security, Zero Knowledge Proofs, Snark, Cryptography, Research.
(Technically the extractor invokes a second prover instance P* with identical input (x,r). The fact that we invoke the prover with the same randomness r makes sure she makes the same (random) choices as P did for the first message a. Hence we rewinded P.) Extractor E chooses a different e’, sends