D004: Forward Secrecy Exemptions

AdminStudio 2023 | 25.0 | Application Manager

D004 scans the app to determine if Forward Secrecy is exempted for any of the domains.

The security of communications transmitted across the Internet can be improved by using public key cryptography. However, if the public and private keys used in those communicators are compromised, it can reveal the data exchanged in that session as well as the data exchanged in previous sessions.

The concept of Forward Secrecy (FS) is the property that ensures that a session key derived from a set of long-term public and private keys will not be compromised if one of the (long-term) private keys is compromised in the future.

AdminStudio examines the application’s metadata to determine if the feature is part of the application’s primary functionality, and whether it calls the feature’s APIs.

Test Group/Test Category

Risk Assessment/Desktop Risk Assessment/macOS Risk Assessment

Severity

•

If the application requires the feature as part of the application’s primary functionality, an Error is generated.

•

If the application calls the feature’s APIs, a Warning is generated.