AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: hybrid-post-quantum-tls-ingress-standard

Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange

Enforces TLS 1.3 ingress configurations to negotiate hybrid post-quantum key encapsulation mechanisms, specifically X25519MLKEM768 (or legacy drafting identifier X25519Kyber768Draft00), while maintaining TLS 1.3 protocol baselines. This standard neutralizes Harvest Now, Decrypt Later (HNDL) attacks targeting enterprise transport layers by guaranteeing that session forward secrecy is anchored by both classical elliptic curves and lattice-based cryptography.

Prohibited Anti-Pattern: Configuring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners.

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange - Enforces TLS 1.3 ingress configurations to negotiate hybrid post-quantum key encapsulation mechanisms, specifically X25519MLKEM768 (or legacy drafting identifier X25519Kyber768Draft00), while maintaining TLS 1.3 protocol baselines. This standard neutralizes Harvest Now, Decrypt Later (HNDL) attacks targeting enterprise transport layers by guaranteeing that session forward secrecy is anchored by both classical elliptic curves and lattice-based cryptography.
globs: **/infra/**/*.{ts,js,tf,json,yaml,yml}, **/ingress/**/*.{ts,js,tf,json,yaml,yml}, **/server/**/*.{ts,js}, **/nginx.conf, **/envoy.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/hybrid-post-quantum-tls-ingress-standard"
---

# Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Configuring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners.

## System Constraints
You are a Principal Security Architect enforcing the Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Negotiation Standard. Mandate that all public-facing and cross-boundary TLS listener configurations specify TLS 1.3 as the strict minimum version and prioritize or require hybrid post-quantum key exchange groups (X25519MLKEM768 or X25519Kyber768Draft00) alongside classical curves. Reject pure-classical ECDHE groups without PQ encapsulation, disallow TLS 1.2 fallback on zero-trust interfaces, and ensure Node.js/Go/Envoy configurations set explicit Post-Quantum Named Groups to defeat Harvest Now, Decrypt Later (HNDL) threats.

## Strict Guidelines
- Services MUST enforce TLSv1.3 as the minimum protocol version ('minVersion: TLSv1.3') on all ingress terminations.
- Engineers MUST specify hybrid Post-Quantum Named Groups ('X25519MLKEM768' or 'X25519Kyber768Draft00') in preferred group order ahead of classical-only curves.
- Configurations MUST NOT include or fall back to deprecated curves such as P-256 (secp256r1) without explicit pairing with an ML-KEM encapsulation mechanism.
- Ingress controllers (e.g., Envoy, Nginx, Node.js HTTPS, Go crypto/tls) MUST bind OpenSSL 3.2+ or BoringSSL libraries compiled with ML-KEM/Kyber support enabled.
- Engineers MUST emit cryptographic audit telemetry logging the negotiated TLS curve/group ('tls_peer_named_group') to verify PQ negotiation rates.

## Bad vs Good Implementations
### Node.js SecureContext Ingress Listener

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Configuring TLS 1.2 and pure classical curves (prime256v1, X25519) allows adversary interception under HNDL (Harvest Now, Decrypt Later) strategies, since traffic captured today can be decrypted by future Cryptanalytically Relevant Quantum Computers (CRQCs).
```typescript
import * as tls from 'node:tls';
import * as fs from 'node:fs';

// Flawed: Allows TLS 1.2 fallback and limits ECDH to classical curves vulnerable to HNDL
export const ingressServer = tls.createServer({
  key: fs.readFileSync('/etc/ssl/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/fullchain.pem'),
  minVersion: 'TLSv1.2',
  ecdhCurve: 'prime256v1:X25519'
});
```

#### Production Standard (Correct)
> **Standard**: Mandates TLS 1.3 strictly and prioritizes the hybrid X25519MLKEM768 key encapsulation mechanism. This combines classical ECDH security with post-quantum lattice cryptography, ensuring session keys remain secure against both classical and quantum adversaries.
```typescript
import * as tls from 'node:tls';
import * as fs from 'node:fs';

// Compliant: Enforces TLS 1.3 minimum and prioritizes X25519MLKEM768 hybrid key exchange
export const ingressServer = tls.createServer({
  key: fs.readFileSync('/etc/ssl/privkey.pem'),
  cert: fs.readFileSync('/etc/ssl/fullchain.pem'),
  minVersion: 'TLSv1.3',
  maxVersion: 'TLSv1.3',
  // Prefers standardized ML-KEM-768 hybrid, falls back to draft identifier if required
  ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00:X25519',
  honorCipherOrder: true
});
```

### Envoy Ingress Downstream TLS Context

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: TLS 1.2 cipher suites rely on classical finite field or elliptic curve Diffie-Hellman without post-quantum hybrid protection, allowing passive collection and future retrospective decryption.
```yaml
common_tls_context:
  tls_params:
    tls_minimum_protocol_version: TLSv1_2
    cipher_suites:
      - ECDHE-ECDSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES256-GCM-SHA384
```

#### Production Standard (Correct)
> **Standard**: Restricts downstream ingress to TLS 1.3 and explicitly orders hybrid post-quantum curves (X25519MLKEM768) at the top of the negotiation list, mitigating HNDL attack surfaces across edge proxies.
```yaml
common_tls_context:
  tls_params:
    tls_minimum_protocol_version: TLSv1_3
    tls_maximum_protocol_version: TLSv1_3
    ecdh_curves:
      - X25519MLKEM768
      - X25519Kyber768Draft00
      - X25519
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

TLS Cryptography Ingress Auditor
Inspects running edge listeners and AST configuration files for post-quantum hybrid curve negotiation compliance.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

PQC Cipherscan CLI
Validates live endpoints for TLS 1.3 X25519MLKEM768 / X25519Kyber768Draft00 support via OpenSSL 3.2+ probes.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange

Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange defines an industrial-grade behavioral standard for security engineering. Enforces TLS 1.3 ingress configurations to negotiate hybrid post-quantum key encapsulation mechanisms, specifically X25519MLKEM768 (or legacy drafting identifier X25519Kyber768Draft00), while maintaining TLS 1.3 protocol baselines. This standard neutralizes Harvest Now, Decrypt Later (HNDL) attacks targeting enterprise transport layers by guaranteeing that session forward secrecy is anchored by both classical elliptic curves and lattice-based cryptography. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Configuring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners. Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftConfiguring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners.Critical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Services MUST enforce TLSv1.3 as the minimum protocol version ('minVersion

Services MUST enforce TLSv1.3 as the minimum protocol version ('minVersion: TLSv1.3') on all ingress terminations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST specify hybrid Post-Quantum Named Groups ('X25519MLKEM768' or 'X25519Kyber768Draft00') in preferred group order ahead of classical-only curves.

Engineers MUST specify hybrid Post-Quantum Named Groups ('X25519MLKEM768' or 'X25519Kyber768Draft00') in preferred group order ahead of classical-only curves.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Configurations MUST NOT include or fall back to deprecated curves such as P-256 (secp256r1) without explicit pairing with an ML-KEM encapsulation mechanism.

Configurations MUST NOT include or fall back to deprecated curves such as P-256 (secp256r1) without explicit pairing with an ML-KEM encapsulation mechanism.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Ingress controllers (e.g., Envoy, Nginx, Node.js HTTPS, Go crypto/tls) MUST bind OpenSSL 3.2+ or BoringSSL libraries compiled with ML-KEM/Kyber support enabled.

Ingress controllers (e.g., Envoy, Nginx, Node.js HTTPS, Go crypto/tls) MUST bind OpenSSL 3.2+ or BoringSSL libraries compiled with ML-KEM/Kyber support enabled.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Engineers MUST emit cryptographic audit telemetry logging the negotiated TLS curve/group ('tls_peer_named_group') to verify PQ negotiation rates.

Engineers MUST emit cryptographic audit telemetry logging the negotiated TLS curve/group ('tls_peer_named_group') to verify PQ negotiation rates.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Enforce Hybrid Post-Quantum TLS 1.3 (X25519MLKEM768) Ingress Key Exchange critical for AI coding assistants?

Enforces TLS 1.3 ingress configurations to negotiate hybrid post-quantum key encapsulation mechanisms, specifically X25519MLKEM768 (or legacy drafting identifier X25519Kyber768Draft00), while maintaining TLS 1.3 protocol baselines. This standard neutralizes Harvest Now, Decrypt Later (HNDL) attacks targeting enterprise transport layers by guaranteeing that session forward secrecy is anchored by both classical elliptic curves and lattice-based cryptography. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Configuring classical-only elliptic curves (e.g., pure X25519 or secp256r1) or allowing TLS 1.2 downgrades on sensitive ingress listeners.) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Enforce