Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've seen both the terms Enhanced Key Usage and Extended Key Usage, and both were abbreviated as EKU. Do both refer to the same extension or property?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

The correct name for the standard extension is Extended Key Usage; see section 4.2.1.12 of RFC 5280. Its OID is 2.5.29.37.

Confusion comes from Microsoft documentation and software:

  • They use "extended key usage" and "enhanced key usage" interchangeably.
  • They defined a Microsoft-specific extension called "Application Policies" (OID 1.3.6.1.4.1.311.21.10) which contains the same information as Extended Key Usage, but with the ASN.1 syntax of "Certificate Policies" (another unrelated extension).
  • Documentation repeatedly talks of storing extended/enhanced key usageS into the Application Policies extension. That is, they use the two expressions "extended key usage" and "enhanced key usage" to designate both the extension and the OID they can put in that extension, or in its clone extension "Application Policies".

Since Microsoft-specific extensions are Microsoft-specific, Microsoft's CA ("Certificate Services") usually includes both extensions (the standard one and the Microsoft one) in issued certificates.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.