Securely transfer files to Broadcom using PQC safe encryption

Products

Generic Non Product

Issue/Introduction

Secure Data Transmission using Post-Quantum Cryptography (PQC).

This article provides instructions for securely signing and encrypting files for transmission to Broadcom using Post-Quantum Cryptography (PQC) in the context of a technical support case. Following these steps ensures that your data remains protected against both current classical threats and future quantum computing capabilities.

Why Post-Quantum Cryptography?

Standard encryption methods like RSA and Elliptic Curve Cryptography (ECC) rely on mathematical problems (like integer factorization) that are easily solved by a sufficiently powerful quantum computer using Shor’s Algorithm.

The "Harvest Now, Decrypt Later" (HNDL) Threat.

Even though "Cryptographically Relevant Quantum Computers" (CRQC) do not fully exist today, adversaries are currently practicing Harvest Now, Decrypt Later. They intercept and store encrypted sensitive data today, intending to decrypt it years from now once quantum technology matures. To defend against this, we must use PQC algorithms that are resistant to quantum attacks today.

Environment

Broadcom has made available scripts and a Windows Client that utilizes an OpenSSL workflow to sign & encrypt the file. Both the provided automation scripts and the Windows application operate strictly locally, requiring no network connectivity, and contain no telemetry or data-tracking mechanisms.

Linux based

Red Hat Enterprise Linux (RHEL) 9.7 includes native support for PQC via OpenSSL.

Note: You do not need to manually compile or install the oqsprovider (Open Quantum Safe) anymore.
OpenSSL has native support since version 3.5 (April 2025), see Release Notes.

PQC file transfer - getting started with the Bash scripts (KB 445035)

Windows based

For Windows environments, we provide both a PowerShell script and a standalone GUI application (BroadcomPQCTool.exe) for key generation and encryption. Both options require a manual installation of OpenSSL (and Coreutils for the script) to function, with setup details and download links conveniently included directly within the GUI app.

PQC file transfer - getting started with the Windows App (KB 445007)
PQC file transfer - getting started with the Windows PowerShell scripts (KB 445021)

Resolution

How to get started?

While the specific workflow varies depending on your chosen method—whether utilizing automated Bash scripts in a Linux environment, manual Windows PowerShell commands, or the standalone Windows GUI application—the underlying core principles remain identical across all options.

Step 1: Create Your Signing Key and certificate.

To secure your uploads, complete a one-time setup to generate a private identity key (.key) and a public signing certificate (.pem). Keep the private key confidential, but share the public certificate with Broadcom via email to vcf-cdm.pqc.pdl@broadcom.com ; Broadcom will automatically reject any uploads that fail signature validation or lack a pre-registered certificate. This flexible framework supports multiple keys per site, credential sharing among administrators, and a recommended 398-day expiration threshold to facilitate regular security rotation. The sample scripts contain details on the -Subject (Common Name) which typically contains your Wolken site ID.

Step 2: Download Broadcom's generic Public Encryption Key.

To encrypt your data so that only Broadcom can decrypt it, save the attached key key_enc_pub_859d63a6_2026-06-16.pem.
This is the "generic" public key and Broadcom may ask you to install a specific one that will be provided to you.

Step 3: Sign & Encrypt a file.

Regardless of whether you utilize the Linux Bash script, Windows PowerShell script, or Windows GUI application, all deployment methods generate the identical secure file format. For bulk uploads, please bundle multiple files into a single compressed archive (e.g., consolidating multiple .tgz files into a single .zip file) prior to processing.

Step 4: Upload the secure file.

This workflow introduces no changes to your existing file transfer methods or transport mechanisms; only the file payload itself is modified. You may continue to utilize your established transmission channels—such as SFTP, Wolken case attachments, or HTTPS uploads via CrushFTP—to submit the secured files.

SFTP instructions (KB 202298)
Uploading VCF log bundles (KB 385549)

Understanding the Security Layers.

This solution employs a hybrid cryptographic approach to ensure both performance and security: bulk data is encrypted using AES-256-CBC (FIPS 197), while the unique, machine-generated session key for each file is protected using Post-Quantum Cryptography (ML-KEM-1024, FIPS 203). File authenticity is guaranteed via ML-DSA-87 (FIPS 204) digital signatures, with the entire technical implementation strictly adhering to the standards outlined in the referenced Cybersecurity Information Sheet.

The generated <uuid>.enc file is a multi-layered security container designed to be "Atomic" - the receiver cannot decrypt the data without verifying your identity first.