Security, Zero Knowledge Proofs, Snark, Cryptography, Research.
message z. Analysing the simulation, we see the simulator S creates a valid interaction of prover and verifier. The verifier accepts the simulated protocol messages because it holds that a·xᵉ = (gᶻ/xᵉ)·xᵉ = gᶻ The simulation (a, e, z) has exactly the same probability distribution as real