Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice [pdf]
weakdh.org