The following commit on edk2 added a new a check on format of Authenticated variables: <a href="https://github.com/tianocore/edk2/commit/c035e37335ae43229d7e68de74a65f2c01ebc0af" target="_blank" rel="noopener"> https://github.com/tianocore/edk2/commit/c035e37335ae43229d7e68de74a65f2c01ebc0af </a><br /><br />After this point some implementations started to have differences in the validation of the format of Authenticator Descriptor as we can se here: <a href="https://blog.hansenpartnership.com/uefi-secure-boot/#comment-48351" target="_blank" rel="noopener">https://blog.hansenpartnership.com/uefi-secure-boot/#comment-48351</a><br /><br />This case make me reach the following discussions: https://bugzilla.tianocore.org/show_bug.cgi?id=586 where i have seen lots of tools(more on linux) dont generate the correct format to use on the payload for TimeBased authenticated variables, at this time i was just trying to create a private authenticated variable, first thig which worked is to use this patch: <a href="https://patchew.org/EDK2/1525903747.5882.11.camel@HansenPartnership.com/" target="_blank" rel="noopener"> https://patchew.org/EDK2/1525903747.5882.11.camel@HansenPartnership.com/ </a><br /><br />But this patch never got merged, so i realized the tools on linux received upgrades to work properly with Authentication Variables of the edk2, but the same code just dont worked at a real machine using a ASROCK board. So my question is, where the developers should trust to consume the UEFI APIs in a trusted way. Another example i had is the path separator "\" or "/", edk2 uses "/" but the spec allow both, ASROCK mix both sometimes it can lead to some errors. I want to know if i can trust if my code work on EDK2 it should work on all other implementations too, and how we will try to remove these ambiguities of interpretation.