PQC file transfer - getting started with the Bash scripts

Products

• Generic Non Product

Issue/Introduction

This guide provides step-by-step instructions for using the Linux scripts to perform Post-Quantum Cryptography (PQC) secure file transfers. This article serves as a supplement to the primary resource, KB 439237.

Resolution

Prerequisites & Installation

• Download the Scripts: Download the attached create_signing_key.sh and send_file.sh scripts.

• Prepare the Environment: Open a Bash shell. Ensure the scripts have execution privileges before running them by executing "chmod +x create_signing_key.sh send_file.sh".

• Generate a Signing Key: Run "./create_signing_key.sh --private-dir .".
  
  

 

• Configure the Certificate Subject: The certificate subject details should be modified to reflect your organization name. Broadcom recommends using naming conventions similar to a standard web server SSL certificate request. However, where you would typically use a hostname for the Common Name (CN) value, substitute your Wolken Site ID, Customer ID, or another unique identifier instead.

• Set Validity Period: The script automatically sets the signing certificate validity period to 398 days. If your organization's security policy requires a different timeframe, you can modify this value by editing the plain-text .sh file directly.

• Submit the Public Certificate to Broadcom: The generation process produces both a private key and a public signing certificate.

  • To allow Broadcom to validate your file transfers, Broadcom must register your public signing certificate in their automation system.

  • Submit this public certificate to Broadcom (e.g., via email or as a plain-text paste within a Wolken support case).

  • Note: This registration only needs to be completed once, or when a certificate expires.

  • Important: Ensure the private key is kept secure and confidential.

• Download the Broadcom Encryption Key: To enable file encryption, download the Broadcom public encryption key attached to KB 439237. The file follows the naming format: key_enc_pub_<hash>_<date>.pem.

 

File Encryption & Transmission

Run the Encryption Wizard: Encrypt and sign your file by explicitly passing the source filename, your generated keys, and the Broadcom public key using the following command:

./send_file.sh --filename vm-support.tgz --my-public-key key_sig_pub_aea33947_2026-06-19.pem --my-private-key key_sig_priv_aea33947_2026-06-19.key --broadcom-public-key key_enc_pub_859d63a6_2026-06-16.pem

• Transmit the Encrypted File: The resulting <uuid>.enc file can now be sent to Broadcom using standard, existing methods (such as a SFTP). The transport workflows remain unchanged, as the script does not transmit files automatically.

 

⚠️ Critical Warning

Broadcom utilizes an automated system to decrypt and validate file signatures. If the signing certificate has expired, or if the public certificate (.pem file) was not submitted and registered beforehand, the automated extraction process will fail entirely.