I am looking at the zero knowledge proof for quadratic residues and am confused when it comes to showing a simulator that can give a transcript of the proof with the same distribution as the proof output itself.
In all explanations/proofs I have seen online the simulator has an element of iteration in it. For instance, taken from here:
Why is that iterative aspect needed? I don't quite understand whose distribution we are trying to show is identical to whose too.
The first message from the prover is random just like it is in the protocol itself, b is a random value in both cases too. The second message from the prover to the verfier is distributed like b. what is this simulator gaining from generating two different messages based on b' and then executing something different based on b?
I've read the paper and other sources too but none seem to directly explain the need for this looping and what exactly it is that we want to be distributed the same way.
Any help is greatly appreciated.