Abstract: Diffie-Hellman key agreement protocol [21] implementations have been plagued by serious security flaws. The attacks can be very subtle and, more often than not, have not been taken into account by protocol designers. In this summary we discuss both theoretical attacks against the Die-Hellman key agreement protocol and attacks based on implementation details . It is hoped that computer security practitioners will obtain enough information to build and design secure and ecient versions of this classic key agreement protocol.

Abstract: Diffie-Hellman key agreement protocol [21] implementations have been plagued by serious security flaws. The attacks can be very subtle and, more often than not, have not been taken into account by protocol designers. In this summary we discuss both theoretical attacks against the Die-Hellman key agreement protocol and attacks based on implementation details . It is hoped that computer security practitioners will obtain enough information to build and design secure and ecient versions of this classic key agreement protocol.

(This paper came in handy during a recent project...)