# How do I construct and use the Okamoto protocol simulator?

Proof Okamoto protocol has zero knowledge if we constructing a suitable simulator

I found the following schema of Okamoto:

But I don't really understand —how can I construct such a simulator and create proofs?

There is "zero knowledge simulator" and "honest verifier zero knowledge simulator". General idea is reversing the order of variables picked at random or cauluated. Namely, pick the simulated challenge and response first, and calculate the first message $a$. For HVZK, just pick a challenge and a response at random, calculate proper first message using verification equation. For ZK, one should get a challenge by querying the real Verifier. This means running a session with Verifier and sending some random first message. Please note I did omit minor details doable as a homework.