Indiscreet Logs: Persistent Diffie-Hellman Backdoors in TLS
eprint.iacr.org