Prove that this protocol based on square roots modulo $n$ is zero knowledge
Here's the simulator $S$ to replace $P$ for challenge $y = x^2 \mod n$:


Choose $a$ randomly from $\mathbb{Z}_n$, draw a bit $b'$ uniformly.
Send $a^2 y^{-b'} \mod n$ to $V$. The inversion is done in $\mathbb{Z}_n$ of course.
$V$ replies with $b$:


If $b = b'$: send $a$ to $V$
Otherwise: abort



If $b'$ is drawn uniformly, then it doesn't matter how $b$ is chosen - the simulator always has exactly probability $0.5$ for the case $b = b'$ for a successfull verification.