AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: ml-kem-hybrid-pqc-tls-enforcement

ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement

Enforces post-quantum hybrid key encapsulation (ML-KEM-768 combined with classical X25519) on TLS 1.3 edge ingress endpoints to eliminate store-now-decrypt-later (SNDL) threats. Edge gateways must mandate TLS 1.3 minimums, prioritize X25519MLKEM768 groups, and prohibit classical-only handshakes for clients that advertise post-quantum capabilities.

Prohibited Anti-Pattern: Permitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress Gateways

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement - Enforces post-quantum hybrid key encapsulation (ML-KEM-768 combined with classical X25519) on TLS 1.3 edge ingress endpoints to eliminate store-now-decrypt-later (SNDL) threats. Edge gateways must mandate TLS 1.3 minimums, prioritize X25519MLKEM768 groups, and prohibit classical-only handshakes for clients that advertise post-quantum capabilities.
globs: src/**/*.{ts,tsx}, infra/**/*.{ts,tf,yaml,yml}, gateway/**/*.{ts,yaml,yml}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/ml-kem-hybrid-pqc-tls-enforcement"
---

# ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Permitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress Gateways

## System Constraints
You are a Principal Security Architect and Cryptographic Systems Engineer. Mandate ML-KEM (FIPS 203) hybrid key agreement (X25519MLKEM768) on all TLS 1.3 ingress points to defend against Store-Now-Decrypt-Later (SNDL) adversaries. Enforce strict TLS 1.3 protocol baselines, disallow downgrade negotiation, and ensure supported curve priorities put post-quantum hybrid KEMs first.

## Strict Guidelines
- Engineers MUST ALWAYS configure TLS listeners with a minimum protocol version of TLS 1.3 (`TLSv1.3`) for zero-trust edge ingress endpoints.
- Engineers MUST ALWAYS prioritize hybrid post-quantum groups, explicitly setting `X25519MLKEM768` (0x11ec) or standard hybrid aliases (`x25519_kyber768`, `X25519MLKEM768`) ahead of standalone classical groups.
- Engineers MUST NOT allow legacy protocols (TLS 1.0, 1.1, or 1.2) on ingress layers handling sensitive enterprise or regulated payloads.
- Code SHOULD validate and log the negotiated TLS key exchange group (`tls_key_exchange_group`) in ingress metrics to alert on sudden classical-only regression spikes.
- Components NEVER permit insecure fallback or silent downgrade ciphers when quantum-resistant key exchanges fail validation.

## Bad vs Good Implementations
### Edge Gateway TLS Context Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Configuring TLS 1.2 as minimum version and leaving ecdhCurve to 'auto' enables classical ECDH key exchange exclusively. Adversaries capturing ciphertext today can decrypt payloads retrospectively using quantum computing (Store-Now-Decrypt-Later).
```typescript
import * as tls from 'node:tls';

// Flawed: Permits TLS 1.2, relies on legacy classical elliptic curves vulnerable to SNDL attacks
export function createEdgeSecureContext(): tls.SecureContextOptions {
  return {
    minVersion: 'TLSv1.2',
    maxVersion: 'TLSv1.3',
    ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384',
    ecdhCurve: 'auto', // Defaults to classical X25519/P-256 without post-quantum ML-KEM protection
    honorCipherOrder: true,
  };
}
```

#### Production Standard (Correct)
> **Standard**: Restricts edge communication to TLS 1.3 and specifies X25519MLKEM768 (standardized under FIPS 203) as the premier key encapsulation group, neutralizing SNDL threats while preserving classical security guarantees.
```typescript
import * as tls from 'node:tls';

// Secure: Enforces TLS 1.3 and prioritizes FIPS 203 ML-KEM hybrid key encapsulation (X25519MLKEM768)
export function createEdgeSecureContext(): tls.SecureContextOptions {
  return {
    minVersion: 'TLSv1.3',
    maxVersion: 'TLSv1.3',
    // Explicitly configure hybrid post-quantum KEMs ahead of legacy curves
    ecdhCurve: 'X25519MLKEM768:x25519_kyber768:X25519:prime256v1',
    honorCipherOrder: true,
  };
}

export function verifyPqcHandshake(socket: tls.TLSSocket): boolean {
  const ephemeralKeyInfo = socket.getEphemeralKeyInfo();
  const group = ephemeralKeyInfo && 'type' in ephemeralKeyInfo ? ephemeralKeyInfo.name : null;
  
  // Audit and alert if client failed to negotiate a hybrid post-quantum group
  const isPqcHybrid = group === 'X25519MLKEM768' || group === 'x25519_kyber768';
  return isPqcHybrid;
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

TLS Configuration Inspector
Inspects and audits ingress gateway TLS listeners and SSL/TLS cipher suites for Post-Quantum Cryptography compliance.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

FIPS 203 Key Exchange Audit
Scans edge reverse proxies, CloudFormation/CDK, and Envoy configurations for mandatory hybrid ML-KEM key exchange settings.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement

ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces post-quantum hybrid key encapsulation (ML-KEM-768 combined with classical X25519) on TLS 1.3 edge ingress endpoints to eliminate store-now-decrypt-later (SNDL) threats. Edge gateways must mandate TLS 1.3 minimums, prioritize X25519MLKEM768 groups, and prohibit classical-only handshakes for clients that advertise post-quantum capabilities. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress Gateways Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftPermitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress GatewaysCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS configure TLS listeners with a minimum protocol version of TLS 1.3 (`TLSv1.3`) for zero-trust edge ingress endpoints.

Engineers MUST ALWAYS configure TLS listeners with a minimum protocol version of TLS 1.3 (`TLSv1.3`) for zero-trust edge ingress endpoints.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST ALWAYS prioritize hybrid post-quantum groups, explicitly setting `X25519MLKEM768` (0x11ec) or standard hybrid aliases (`x25519_kyber768`, `X25519MLKEM768`) ahead of standalone classical groups.

Engineers MUST ALWAYS prioritize hybrid post-quantum groups, explicitly setting `X25519MLKEM768` (0x11ec) or standard hybrid aliases (`x25519_kyber768`, `X25519MLKEM768`) ahead of standalone classical groups.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Engineers MUST NOT allow legacy protocols (TLS 1.0, 1.1, or 1.2) on ingress layers handling sensitive enterprise or regulated payloads.

Engineers MUST NOT allow legacy protocols (TLS 1.0, 1.1, or 1.2) on ingress layers handling sensitive enterprise or regulated payloads.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Code SHOULD validate and log the negotiated TLS key exchange group (`tls_key_exchange_group`) in ingress metrics to alert on sudden classical-only regression spikes.

Code SHOULD validate and log the negotiated TLS key exchange group (`tls_key_exchange_group`) in ingress metrics to alert on sudden classical-only regression spikes.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Components NEVER permit insecure fallback or silent downgrade ciphers when quantum-resistant key exchanges fail validation.

Components NEVER permit insecure fallback or silent downgrade ciphers when quantum-resistant key exchanges fail validation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is ML-KEM (FIPS 203) Hybrid Post-Quantum TLS 1.3 Key Exchange Enforcement critical for AI coding assistants?

Enforces post-quantum hybrid key encapsulation (ML-KEM-768 combined with classical X25519) on TLS 1.3 edge ingress endpoints to eliminate store-now-decrypt-later (SNDL) threats. Edge gateways must mandate TLS 1.3 minimums, prioritize X25519MLKEM768 groups, and prohibit classical-only handshakes for clients that advertise post-quantum capabilities. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permitting Classical-Only TLS Key Exchange on Sensitive Edge Ingress Gateways) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

ML-KEM