## Background
### NIZK in the Random Oracle Model
We say that \((\mathcal{P}^{H},\mathcal{V}^{H})\) is simulation-sound with respect to \(\mathcal{S}\) in the random oracle model if for all PPT adversaries \(\mathcal{A}\) the advantage \(\epsilon_{\mathsf{SS}}\) such that_  
\[\epsilon_{\mathsf{SS}}(\lambda) =\Pr[(\mathsf{stmt}^{*},\pi^{*})\leftarrow\mathcal{A}^{\mathcal{ S}_{1}(\cdot),\mathcal{S}_{2}^{\prime}(\cdot)}(\lambda):\] \[(\mathsf{stmt}^{*},\pi^{*})\
eq\mathcal{T}\wedge\mathsf{stmt}^{* }\
eq\mathcal{L}\wedge\mathcal{V}^{\mathcal{S}_{1}}(\mathsf{stmt}^{*},\pi^{*} )=1]\]  
_is negligible, where \(\mathcal{T}\) is the list of pairs \((\mathsf{stmt}_{i},\pi_{i})\), i.e., (true or false) statements queried to and proofs returned by the simulator._  
**Theorem 1** (Fiat-Shamir NilZKs [14]). : _Consider a three-round HVZK interactive proof system \((\mathcal{P},\mathcal{V})\) for a language \(\mathcal{L}\in\mathit{NP}\) with completeness. Let \(H\) be a function with range equal to the space of the verifier's coins. In the random oracle model, the proof system \((\mathcal{P}^{H},\mathcal{V}^{H})\) derived from \((\mathcal{P},\mathcal{V})\) by applying the Fiat-Shamir transform is unbounded non-interactive zero-knowledge._  
**Theorem 2** (Simulation Soundness of Fiat-Shamir NilZKs [14]). : _Consider a three-round HVZK interactive proof system \((\mathcal{P},\mathcal{V})\) for a language \(\mathcal{L}\in\mathit{NP}\) with completeness, soundness, and unique response. In the random oracle model, the proof system \((\mathcal{P}^{H},\mathcal{V}^{H})\) derived from \((\mathcal{P},\mathcal{V})\) via the Fiat-Shamir transform is simulation-sound NIZK with respect to its canonical simulator \(\mathcal{S}\)._  
By applying the above theorems to the previous interactive protocols for proving the _equality_ and _linearity_ of discrete logarithms, we can obtain NIZK proof systems for the equality and linearity of discrete logarithms, which both have the properties of zero-knowledge and simulation soundness. Note that the two previous interactive protocols satisfy the completeness, HVZK, (statistical) soundness, and unique response properties. To measure the concrete bounds of the advantages \(\epsilon_{\mathsf{ZK}}\) and \(\epsilon_{\mathsf{SS}}\) with respect to the two interactive protocols, we follow the proofs in [14] (Theorems 1 and 2 therein). First, \(\epsilon_{\mathsf{ZK}}\) of the NIZK systems is bounded by the probability that the \"good\" NIZK simulator \(\mathcal{S}\) fails and aborts during the simulation. Note that the NIZK simulator \(\mathcal{S}\) fails when a collision of the random oracle \(H\) happens in the process of updating the hash table \(\mathcal{T}_{H}\). Because the probability that a collision happens is at most \(q_{H}^{2}/p\), where \(q_{H}\) is the maximum number of \(H\) queries and \(p\) is the group order including the size of the challenge space, we see that \(\epsilon_{\mathsf{ZK}}\leq q_{H}^{2}/p\). Second, \(\epsilon_{\mathsf{SS}}\) of the NIZK scheme is bounded by \(q_{H}\cdot\epsilon_{\mathsf{snd}}+q_{H}^{2}/p\), where \(\epsilon_{\mathsf{snd}}\) denotes the bound of advantage that the adversary violates the _soundness_ of the proof system \((\mathcal{P},\mathcal{V})\). The _soundness_ bound \(\epsilon_{\mathsf{snd}}\) in the two interactive protocols is statistically the same as the inverse of the size of the challenge space, \(1/p\), so we see that \(\epsilon_{\mathsf{SS}}\leq(q_{H}+q_{H}^{2})/p\).