In the paper describing a protocol for distributed RSA modulus generation, Diogenes, "[they] employ a special-purpose $\Sigma$-protocol based on [Sho00] for proving correctness of exponentiations in a hidden-order group."
If it says this explicitly I haven't found it, but I am assuming the hidden-order group is the $\mathbb{Z}_N^{\times}$ where $N$ is the biprime candidate being tested. I should note that while that biprime is (if passed) assumed to be the product of primes $p$ and $q$, where $p \equiv_4 q \equiv_4 3$, $p$ and $q$ are not assumed to be safe primes, which is given as a requirement in [Sho00].
In [Sho00] there are publicly known $g$, $h$, and $a$, each of which are quadratic residues in publicly known $N$. A trusted dealer randomly selects quadratic residue $g$, so that, considering $N$ is composed of two safe primes, with overwhelming probability $g$ generates the group of quadratic residues $N$. A prover (in Shoup's case, a signer) has a secret exponent $x$ (i.e. signature key) where the discreet log of $a$ base $g$ is $x$. The prover signs $h$ by publishing $b \equiv_N h^x$ and an argument that an exponent $x$ exists where $g^x \equiv_N a$ and $h^x \equiv_N b$.
Shoup stresses that in order for the protocol to be sound, then $g$ must generate over a superset of $\{g, h, a, b\}$. Recall that we are already assuming $g$ generates over the quadratic residues, and $g$, $h$, and $a$ are each quadratic residues, but $b$ is not guaranteed to be a quadratic residue until after the relationship is proved, creating a circular dependency. Shoup gets around this by by instead having the prover give an argument that an exponent $x$ exists where $g^x \equiv_N a$ and $(h^2)^x \equiv_N b^2$, because any party can trivially derive $h^2$ and $b^2$ from $h$ and $b$ respectively.
I'm guessing the condition that $N$ be composed of safe primes is not needed as long as $g$ can be shown to generate over a superset of $\{g, h, a, b\}$. I do not know how this is done in Diogenes.
