PQC file transfer - getting started with the Windows PowerShell scripts

Products

• Generic Non Product

Issue/Introduction

This guide provides step-by-step instructions for using the Windows PowerShell scripts to perform Post-Quantum Cryptography (PQC) secure file transfers. This article serves as a supplement to the primary resource, KB 439237.

Resolution

Prerequisites & Script Preparation

• Download the Scripts: Download the attached create_signing_key.ps1 and send_file.ps1 scripts.
  
  

• Open PowerShell: Launch PowerShell as a standard user (do not run as Administrator).

• Execution Policy & Unblocking: Execute create_signing_key.ps1. If you encounter an UnauthorizedAccess error, it is because these scripts are unsigned templates. After reviewing the scripts to ensure you trust them, run the following three commands to unblock them and adjust your execution policy:

  Unblock-File -Path .\create_signing_key.ps1
  Unblock-File -Path .\send_file.ps1
  Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
  

 

• Install OpenSSL: If OpenSSL is not yet installed on your system, follow the provided link to download Win64 OpenSSL Light (the Light version is sufficient).

  • Run the installer using the default settings.

  • If prompted that the Microsoft Visual C++ Redistributable package is missing, download and install it as well.

• Install Microsoft Coreutils: In PowerShell run "winget install Microsoft.Coreutils".

Generating the Signing Key and Certificate

• Execute the Key Generation Script: Run the script using the -Subject parameter.

• Configure the Certificate Subject: Generating the signing key also creates a certificate requiring a -Subject field, similar to a standard SSL certificate. Broadcom recommends using naming conventions similar to a web server certificate request. However, where you would typically use a hostname for the Common Name (CN) value, substitute your Wolken Site ID, Customer ID, or another unique identifier instead.

• Validity Period: The script automatically sets the signing certificate validity period to 398 days. If your organization's security policy requires a different timeframe, you can modify this value by editing the plain-text .ps1 file directly.
  
  

Certificate Registration & Broadcom Keys

• Submit the Public Certificate to Broadcom: The script generates a private key and a public signing certificate.

  • To allow Broadcom to validate your file transfers, Broadcom must register your public signing certificate in their automation system.

  • Submit this public certificate to Broadcom (e.g., via email or as a plain-text paste within a Wolken support case).

  • Note: This registration only needs to be completed once, or when a certificate expires.

  • Important: Ensure the private key is kept secure and confidential.

• Download the Broadcom Encryption Key: To enable file encryption, download the Broadcom public encryption key attached to KB 439237. The file follows the naming format: key_enc_pub_<hash>_<date>.pem.

File Encryption & Transmission

• Review Encryption Help: Run .\send_file.ps1 to view the script's help menu and available parameters.
  
  

• Key Detection: If the Broadcom encryption key, your private signing key, and your public signing certificate are all located in the same directory as the script, the tool will automatically detect them. You will only need to provide the filename of the source file to be encrypted and signed. If they are in separate locations, you must explicitly specify the path to each component using the script's parameters.
  
  

• File Locations: The source file can reside on a network drive. However, please note that all temporary files will be created in the same directory as the source file.
  
  

• Transmit the Encrypted File: The resulting <uuid>.enc file can now be sent to Broadcom using standard, existing methods (such as a Wolken case attachment, CrushFTP, or SFTP). The transport workflows remain unchanged, as the script does not transmit files automatically.

 

ℹ️ Administrative Note

It is common for a vSphere Administration Team to collectively manage Broadcom support cases. You may share the script folder, keys, and the certificate pair among multiple team members, or host them on a shared network drive. There is no requirement for each individual administrator to maintain a unique key and certificate, as doing so introduces unnecessary administrative overhead for both parties.

 

⚠️ Critical Warning

Broadcom utilizes an automated system to decrypt and validate file signatures. If the signing certificate has expired, or if the public certificate (.pem file) was not submitted and registered beforehand, the automated extraction process will fail entirely.

Additional Information