Let $q$ be a given random prime of $2b$-bit for some security parameter $b$ (say $b=128$); let $p$ be a given much larger random prime with $p=q\cdot r+1$. Let $(G,*)$ be the (Schnorr) subgroup of $\mathbb Z_p^*$ with $x\in G\iff x^q\equiv1\pmod p$. Assume $p$ is large enough that the Discrete Logarithm Problem is computationally hard for a(ny) generator of $G$, that is requiring effort $O(2^b)$.
Starting from a given hash $H$ conjectured computationally secure in the random oracle model (say SHA-256 or SHA-512), we want to construct a public, easily computable hash $\hat H$ with result in $G$, computationally secure in the random oracle model, and such that for any generator $g$ of $G$, it is computationally hard to exhibit $m$ and $x$ with $g^x\bmod p\;=\;H(m)$.
Does $\hat H(m)\;=\;H(m)^r\bmod p$ qualify? If yes, what formal argument can we give (perhaps making some plausible hypothesis), and how wide does $H$ needs to be? Otherwise, what's a simple alternative?
Note: I'm willing to tolerate the issue that $H(m)^r\bmod p$ has a small chance to be zero, which is not a member of $G$, since it is computationally impossible to exhibit an $m$ with this property.
Motivation: I'm trying to simplify my laborious construction of $H_2$ in that answer.
