# Equivalence between "Discrete Log Relation" and Discrete Log

I am trying to understand Bulletproofs and it uses the following assumption (Section 2.1): Note: $$\mathbb{G}$$ is of prime order $$p$$.

My question is about the last sentence in the image -- I cannot prove it. Specifically, I want to prove that $$(*)$$ if Discrete Log Relation is "broken", then the "plain" Discrete Log is also broken. Intuitively this makes sense, but I must be careful since I am just beginning self-learning cryptography.

An attempt for proving $$(*)$$: To break plain DL, I must find $$x\in\mathbb{Z}_p$$ s.t. $$g^x=h$$. Adversary $$\mathcal{A}$$ breaking DLR for $$n=2, g_1 = g, g_2 = -h$$ would give $$a_1', a_2' \in \mathbb{Z}_p$$. However, there is no guarantee that $$a_2' = 1$$ so that $$a_1' = x$$, unless there is a way to "convert" $$(a_1',a_2')$$ to $$(x, 1)$$. I am stuck here.

However, there is no guarantee that $$a_2' = 1$$ so that $$a_1' = x$$, unless there is a way to "convert" $$(a_1',a_2')$$ to $$(x, 1)$$. I am stuck here.
• $$g^{a}(g^x)^{b} = 1$$ is equivalent to saying that $$a + bx = 0 \pmod q$$, where $$q$$ is the order of the element $$g$$; this is true even if $$g^x = h$$
• If we know a value $$b \ne 0$$, and $$q$$ is prime, then is it feasible to find a value $$b'$$ such that $$b \cdot b' = 1 \pmod q$$?