Diffie-Hellman and its disadvantage with large primes
Let $p$ be a prime number and denote by $\mathbb{Z}_p$ the ring of integers modulo $p$.
The set $\mathbb{Z}_p^*$ typically denotes the units of $\mathbb{Z}_p$.
This set is defined as $$\mathbb{Z}_p^* = \{n \in \mathbb{Z}_p : \exists m \in \mathbb{Z}_p, nm = 1\},$$ where arithmetic is done modulo $p$.
An important fact about $\mathbb{Z}_p$ is that it is a field.
This means that we can simplify the above to $\mathbb{Z}_p^* = \{1, 2, \ldots, p-1\}$.
This set forms a group under multiplication, and it is a standard fact that this is a cyclic group, i.e., it is isomorphic to $\mathbb{Z}_{p-1}$ where the group operation is addition.
In symbols, $(\mathbb{Z}_p^*,\times) \cong (\mathbb{Z}_{p-1},+)$.

Since $p-1$ is even, consider the two-element subset of $\mathbb{Z}_{p-1}$ given by $\left\{0,\frac{p-1}{2}\right\}$.
As $\frac{p-1}{2} + \frac{p-1}{2} = p-1 = 0$ in $\mathbb{Z}_{p-1}$, this set forms a subgroup of $\mathbb{Z}_{p-1}$.
The order of a subgroup is its cardinality as a set, so this is a subgroup of order two.

Via the isomorphism between $(\mathbb{Z}_{p-1},+)$ and $(\mathbb{Z}_p^*,\times)$, this corresponds to a subgroup of $\mathbb{Z}^*_p$ of order two.