Any plan to enforce the x509 EKU check?

["Gary Lin" <glin@suse.com>]

Hi,

My colleagues recently raised a question to me: does UEFI enforce the
x509v3 extended key usage check, such as CodeSigning, for Secure Boot?
(Some certification such as NIAP OS PP requires the OS to verify EKUs
 of x509 certs, and they wonder if UEFI requires similar checks.)

I did a quick check and found that the EKU check functions were already
implemented(*). What's interesting is that VerifyEKUsInPkcs7Signature()
has no real user. The function has been introduced for a while, so I
wonder if there is any plan to enforce the EKU check. Or, is it just an
API for the firmware vendor to customize the their firmware rather than
a general check for all platforms in the future?

Thanks,

Gary Lin

(*) https://bugzilla.tianocore.org/show_bug.cgi?id=1402