PQC file transfer - getting started with the Windows App

Products

• Generic Non Product

Issue/Introduction

This guide provides step-by-step instructions for using the BroadcomPQCTool.exe Windows application to perform Post-Quantum Cryptography (PQC) secure file transfers. This article serves as a supplement to the primary resource, KB 439237.

Environment

Release Date	SHA256
2026-06-17	49FD33D5D6B22CD4B7AAD09697F63213C4F4178094992155D457449A413BDA8D
2026-07-16	730B1FECA1113DA60A46013E54824A8FC3F96E534337103183BDDFF7C0F7A220

Resolution

Note

This application does not include built-in update functionality.

Broadcom recommends subscribing to this KB article to receive notifications when new versions become available.

 

Prerequisites & Installation

• Download the Tool: Download the attached BroadcomPQCTool.exe executable.
  
  

• Verify File Integrity: Validate the checksum of the downloaded file against the SHA256 hash listed in this KB article. You can use the following PowerShell command:

  PowerShell PS>

  Get-FileHash -Algorithm SHA256 .\BroadcomPQCTool.exe
  

  

• Install OpenSSL: If OpenSSL is not yet installed on your system, follow the provided link to download Win64 OpenSSL Light (the Light version is sufficient).

  • Run the installer using the default settings.

  • If prompted that the Microsoft Visual C++ Redistributable package is missing, download and install it as well.

• Relaunch the Tool: Restart BroadcomPQCTool.exe. The application interface should now show OpenSSL as successfully installed.
  
  

Key and Certificate Configuration

• Establish a Signing Key: * If you have a previously generated Signing Key, click to import it.

  • Otherwise, generate a new one by clicking Create Signing Key.

• Configure the Certificate Subject: Generating the signing key also creates a certificate that requires a -Subject field, similar to a standard SSL certificate. Broadcom recommends using a naming convention similar to a web server certificate request. However, where you would typically use a hostname for the Common Name (CN) value, substitute your Wolken Site ID, Customer ID, or another unique identifier instead.
  
  

• Set Validity Period: Select the desired validity duration for the signing certificate. The default period is 1 year, but this can be adjusted to meet your organization's specific security policies.
  
  

• Submit the Public Certificate to Broadcom: The generation process produces two files: a private key (.key) and a public signing certificate (.pem).

  • To allow Broadcom to validate your file transfers, Broadcom must register your public signing certificate in their automation system.

  • Submit this public certificate to Broadcom (e.g., via email or as a plain-text paste within a Wolken support case).

  • Note: This registration only needs to be completed once, or when a certificate expires.

  • Important: Ensure the private key is kept secure and confidential.
    
    

• Import the Broadcom Encryption Key: To enable file encryption, you must next import the Broadcom public encryption key. This key is attached to KB 439237 and follows the naming format: key_enc_pub_<hash>_<date>.pem.
  
  

The application is now fully configured and functional.

File Encryption & Transmission

• Run the Encryption Wizard: Click Encrypt File... to launch the encryption and signing wizard.

  • Note: The source file can reside on a network drive; however, all temporary files will be generated in the same directory as the source file. We are not using %TEMP% to prevent the local disk from running out of space.

• Transmit the Encrypted File: The resulting <uuid>.enc file can now be sent to Broadcom using standard, existing methods (such as a Wolken case attachment, CrushFTP, or SFTP).

  • The transport workflows remain unchanged, as the application does not transmit files automatically.

 

ℹ️ Administrative Note

It is common for a vSphere Administration Team to collectively manage Broadcom support cases. You may share the application, the settings.cfg file, and the key/certificate pair among multiple team members, or host them on a shared network drive. There is no requirement for each individual administrator to maintain a unique key and certificate, as doing so introduces unnecessary administrative overhead for both parties.

 

⚠️ Critical Warning

Broadcom utilizes an automated system to decrypt and validate file signatures. If the signing certificate has expired, or if the public certificate (.pem file) was not submitted and registered beforehand, the automated extraction process will fail entirely.

Additional Information