You've requested...

Diffie-Hellman Key Exchange - A Non-Mathematician's Explanation

If a new window did not open, click here to view this asset.

Download this next:

The exploitation of flaws in the HTTPS protocol

The HTTPS protocol is a vital tool in safeguarding the security of our personal and business lives. This protocol ensures that important data such as financial information, intellectual property and login credentials are encrypted and integrity protected as they travel across the internet. Ultimately this means a malicious observer is unable to obtain, view, use or sell this important data. To both technical and non-technical users, the presence of “HTTPS” at the start of the website URL will provide enough confidence to consider entering sensitive information such as bank or credit card details. However, in this article we will explain how even websites owned by the most reputable organisations may be exposed to a 20-year-old attack – originally known as the “Million Message Attack” due to Daniel Bleichenbacher – if HTTPS is not properly implemented. Around 33% of internet servers were found to be vulnerable to this attack in 2016, and both Facebook and PayPal remained vulnerable in 2017. Furthermore, related weaknesses in HTTPS implementations are still regularly being discovered. As a result, a secure TLS implementation is imperative for all organisations looking to maintain their business reputations and sensitive intellectual property.

These are also closely related to: "Diffie-Hellman Key Exchange - A Non-Mathematician's Explanation"

  • Definitive Guide to Exchange Server 2010 Migration: Chapter 1: Under the Hood of Exchange Server 2010

    Exchange Server 2010 has been hailed as more than just an upgrade from Exchange 2007. Its improved email-archiving, high-availability and storage features seem to have solved many Exchange administrator and user frustrations. So, maybe now is the time for your organization to upgrade to Exchange 2010. Do you know what you’re getting into? Do you have a plan?

    This expert e-book highlights all the complicated aspects of migrating to this new platform. Discover how to move further along in the migration process, with details describing key topics such as:

    • How to properly document an upgrade for administrators and users
    • Step-by-step directions on how to move from Exchange 2003 or Exchange 2007 to Exchange Server 2010
    • Exchange testing dos and don’ts
    • Key management tips and tricks to keep your servers running at peak condition

    Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries.


  • Exchange Insider E-Zine - Volume 10: Who’s Reading Your Email?

    With more business being conducted via email and an increasing reliance on messages, concerns about mail server security, accessibility and admin privileges (or excessive privileges) are completely valid. Volume 10 of the Exchange Insider e-zine dissects two types of Exchange 2010 auditing—administrator audit logging and mailbox audit logging—and explains why you should use them. Even though virtualizing Exchange Server can improve scalability, flexibility and disaster recovery, it’s not a matter of if you will have problems, but when. Here’s what to do when virtual Exchange goes haywire.

    Sponsored by: thawte

Find more content like what you just read:

  • Expert ways to maximize security in Exchange

    This expert e-guide provides tips for maximizing Exchange security, including how to leverage the enhanced capabilities in Forefront Protection 2010. In addition, it reviews the 6 most commonly overlooked Exchange security vulnerabilities.


  • Explaining How Trusted SSL Certificates and Forged SSL Certificates Work

    This expert e-guide explores how trusted and forged SSL certificates work, as well as the dangers that arise from compromised Certification Authorities (CAs). Discover what you need to know about the state of the digital marketplace today – read on to learn more.


  • Expert E-zine: Who has access to your email?

    In this edition of The Exchange Insider, explore the next steps for your email messaging platform with the following Exchange topics: Evaluating Office 365, auditing Exchange 2010 and troubleshooting virtualized Exchange Servers.


  • Zero trust explained: Whiteboard demonstration

    Zero-trust is a key strategy in today’s security landscape, but how exactly does it work? In this video, HashiCorp presents a real-time demonstration of zero-trust network security principles, providing an introduction to the strategy, and articulating their specific vision for zero-trust security. Watch now to learn more.


  • How Russia's war in Ukraine is changing the cybersecurity game and why that matters

    The build-up to the attack on Ukraine by Russia saw warnings from security pros that the world was on the verge of a cyber war. So far, such attacks have been confined to the theatre of conflict, but this doesn't mean things won't change. In this e-guide, we explore some of the more impactful cybersecurity stories that have unfolded around the war.


  • Jargon buster guide to GDPR

    In this guide, we provide the 10 most important things you need to know about GDPR, and a jargon-buster explanation for some of the key terminology.


  • Storage Buyer's Checklist: Solid-State Storage Arrays

    In this expert Essential Guide, check out solid-state storage array options, purchasing considerations and access a buyer's feature checklist. Make a better decision today!


  • Exchange Migration E-Book Chapter 2: Mastering the Art of Migration Documentation

    This sample chapter explains how to draft a useful migration document and outlines key points your Exchange Server upgrade document should include, such as management strategies, storage design, software compatibility and more.


  • Step-by-step Guide to Migrating from Exchange 2003 to Exchange 2010

    While Exchange 2010 promises to offer enhanced communication and collaboration capabilities, the migration process can still be a challenge for even the most diligent IT professional. Take a look at this e-book from the editors at for a top-to-bottom, expert analysis of the Exchange migration process.


  • Virtualizing your Exchange Server: Fact vs. fiction

    Find out what's fact and what's fiction about virtualizing your Exchange Server. What steps should you take, and how can you ensure success? Explore all these questions and more in this e-book.


  • Exchange Insider E-Zine vol. 11: Office 365, mobile devices, Exchange security

    In this edition of the Exchange Insider E-Zine, explore how to migrate to Office 365, support mobile devices and protect your Exchange Server environment from the latest threats.


  • Top Priorties for Evaluating Microsegmentation Solutions

    This report from Enterprise Strategy Group (ESG), in partnership with Akamai, offers a detailed explanation of how to prioritize microsegmentation evaluation decisions. It provides the eight key priorities to consider when selecting solutions, as well as research on microsegmentation adoption in the marketplace.


  • IT Handbook: Exchange Virtualization for VMware

    VMware has received a lot of attention for its flexibility and reliability, but that doesn't guarantee it's the best hypervisor for your Exchange environment. This IT handbook examines how VMware compares to Microsoft and Citrix and discusses tools and tips to help you navigate the Exchange virtualization process with ease.


  • Jargon Buster Guide to Post Quantum Cryptography

    This Jargon Buster will help you to understand the key concepts of quantum computing and why businesses should be acting now to ensure they are able to encrypt sensitive data in a secure way in a post-quantum era.


  • 2 types of endpoint encryption to protect data

    Endpoint encryption can ensure data remains safe from unauthorized access when it is stored and transmitted to another endpoint. Two main approaches to endpoint encryption that companies can implement to protect data are full-disk encryption and file encryption.


  • Secure sockets layer: What is it really about?

    You may have heard of "SSL: Secure Sockets Layer" but there hasn't been a consistent definition/assessment of the scope of the term...until now.Go onto the landing page now to learn about SSL, through a succinct definition, as well as an in-depth explanation going into its origin and significance.


  • E-Book: Definitive Guide to Exchange 2010 Migration Chapter 4: Load Testing and Security Exchange 2010

    This chapter explains how to test Exchange 2010 with native and third-party management tools and how best to protect your investment.


  • E-Guide: Requirements for Virtualizing Exchange Server 2010

    This expert e-guide provides you with everything you need to know about virtualizing Exchange 2010. Discover the hardware, storage, memory, and availability requirements you will have to meet as well as the steps you must take before getting started with this process.


  • 7 NAS encryption best practices to protect data

    NAS encryption helps organisations prevent unauthorized individuals from gaining access to confidential data. However, the process is complex and, if done incorrectly, can put sensitive data at risk. Here are seven NAS encryption best practices to protect your data.


  • Top strategies to master an Exchange 2010 migration

    Find out how you can avoid the most common mistakes that Exchange admins make when migrating to Exchange 2010 in this e-guide. Plus, gain tips for how to properly document and plan your migration.


  • Logi Bolt wireless technology at a glance

    Download this e-book to gain access to best practices and recommendations for optimizing the performance of Logi Bolt wireless products in your workplace environment.


  • EDR: Endpoint Detection Response

    You’ve probably heard of EDR, but with so many acronyms in the security space, you may not know what it stands for or what it really means.Access this exclusive landing page to explore expert opinions and explanations of EDR’s origin and modern importance.


  • ZTNA: What it stands for & what it means

    ZTNA is one of the hottest acronyms in the cybersecurity space. While many people know what it stands for, different interpretations focus on different things.Go onto the landing page now to learn about ZTNA, through a succinct definition, as well as an in-depth explanation going into its origin and significance.


  • Defining APIs: Why they matter

    API is a commonly used acronyms in the cybersecurity space, and while many have a loose understanding of what it stands for, there is still a lack of clarity surrounding what APIs actually do. Go onto the landing page now to learn about APIs, through a succinct definition, as well as an in-depth explanation going into its origin and significance.


  • Learn application security in a practical way

    Application security is a hot topic in the digital-first era. Developers today face more cyber threats than ever before. Because of that, it is critical that all developers continue to enhance their skillset. For those developers who want to learn more about app security, but in a practical way, this eBook is what you need. Read on to learn more.


  • Transport layer security: What it is & what it means

    You’ve probably heard of transport layer security (TLS), but with so many acronyms in the security space, you may not know what it stands for or what it really means.Access this exclusive landing page to explore expert opinions and explanations of TLS’s origin and modern importance.


  • About to Buy Guide: Spam/virus protection for Exchange

    This expert e-guide explores the value of a comprehensive email security strategy, and compares the pros and cons of various approaches. Discover how you can gain the antispam and antivirus protection you need to keep email threats at bay and productivity high.


  • Cloud computing storage key management

    Jagat Paudel addresses key management in cloud computing storage in this thesis from our Royal Holloway security series.


  • A Look Inside the Top Four Value-Based Care Plans

    Payers have several different value-based care arrangements they can offer, including pay-for-performance programs, bundled payment models, and capitation.


  • Exchange Server: E-mail Archiving and Security

    Review today's best (and worst) practices for email archiving inside this Exchange e-guide. Gain expert tips and tricks for managing and monitoring your Exchange servers along with six commonly overlooked security vulnerabilities to look out for.


  • 2020 Media Consumption Series - What

    In this inforgraphic, we show the results of our 2020 Media Consumption Survey. Find out what prospects' advice is for your content creation team and what data users are willing to share in exchange for quality content?


  • How to use a public key and private key in digital signatures

    Ensuring authenticity of online communications is critical to conduct business. Learn how to use a public key and private key in digital signatures to manage electronic documents.


  • Brush up on your understanding of key cybersecurity terms

    Cybersecurity is filled with acronyms and terms that can be difficult to fully understand, which can lead to confusion and intimidation for potential interested parties. In this blog post, Nexum introduce their Acronym Series, which aims to spread cybersecurity awareness by providing explanations of various acronyms. Read now to learn more.


  • Computer Weekly – 30 January 2024: Tech companies warn EU over encryption plans

    In this week's Computer Weekly, tech companies are calling on the European Commission to rethink plans to weaken internet encryption – we explore the issues. We talk to credit rating agency Moody's about why it thinks now is the time to invest in quantum computing. Read the issue now.


  • Improve customer experience with good customer data

    Learn how you can build customer loyalty and improve customer experiences via quality and effective customer data collection and analysis. In addition, tap into how companies like 7-Eleven, Walgreens, and Mazda are improving customer journeys by enabling mobile loyalty programs.


  • CW Innovation Awards Project of the Year: StratMed

    Named Project of the Year in the Computer Weekly Innovation Awards APAC 2022, StratMed's Integer platform is facilitating data exchanges between healthcare providers and their suppliers to improve transparency in India's healthcare supply chain.


  • Securing identities in today’s digital business

    As organizations continue to evolve digitally, the volume of sensitive keys, identities, and data is increasing. Utimaco SecurityServer bundles 30 years of experience in cryptography and Hardware Security Module (HSM) technology into a unique offering that constitutes the root of trust for security and compliance. Read on to learn more.


  • NY health plan improves quality measures with health exchange

    Healthfirst, a NY health plan, used real-time data from its health exchange, accessing 700+ facilities, to boost quality measures and care coordination. This led to a 5-6% increase in compliance. The nonprofit aims to enhance the program for better event identification and provider alerts. Learn more in this case study.


  • Exchange Insider E-Zine Vol. 14: Securing Mobile Devices and Exchange

    This essential e-zine reviews key BYOD concerns and considerations for Exchange admins, and offers tips for addressing the technical logistics of delivering secure email access to mobile devices. Learn how to leverage PowerShell scripts, ActiveSync data, and more.


  • Why a data intelligence platform is crucial for enablement

    Many companies often see a lack of widespread adoption for new data products by key stakeholders. Read on to learn why a rich, data-driven culture requires an organization to have a singular platform through which data can be exchanged.


  • Your Guide to Zero-Trust Security

    Implementing zero trust requires creating detailed policies and devising certain "hoops" through which those wanting access to critical infrastructure must jump. Not an easy task. Luckily, searchSecurity is here to help. Participate in our IAM research program for access to our guide, Implementing a Zero-Trust Approach to Network Security.


  • Mobile Device Security Best Practices for BYOD

    This expert E-Guide from explores the issue of mobile device security and offers best practices for making a BYOD program work in your organization.


  • Are you making your users pay a Time Tax?

    Time tax refers to the irritating, inefficient, and time-wasting processes imposed on members of the public in exchange for public assistance. Are you making your users pay a Time Tax? Download this white paper and fill out the quiz to discover if you’re guilt of any of the common time tax pitfalls.


  • The next generation of hardware security modules

    In the wake of digital transformation, hackers have taken advantage of the expanding attack surface to deliver an unprecedented scale of attacks. Utimaco’s next generation HSM, Anchor, is designed to deliver a leap forward in security and innovation, bringing together robust encryption and secure key management. Read on to learn more.


  • IT Handbook: Offsite Messaging Decisions for the Exchange Admin

    Hosting Exchange Server off-site may appeal to businesses getting comfortable with the idea of cloud computing and its various advantages, but is it really a good idea?


  • Successfully embracing digital feedback processes

    Valuable data is often hidden away in email exchanges or scattered across various documents and sources, making it difficult for organizations to drive insights. That’s why a global marketing communications agency sought out a digital feedback system that could seamlessly integrate with their current tools. Read on to learn how they found success.


  • 9 Common Cryptocurrency Scams in 2023

    Even though cryptocurrency is a newer trend, thieves are using old methods to steal. Here are some of the common cryptocurrency scams to watch out for.