ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement

--- description: ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement - Enforces dual-key post-quantum hybrid key encapsulation (X25519MLKEM768 / FIPS 203) across all public edge ingress terminations and reverse proxies. Prevents Store-Now-Decrypt-Later (SNDL) exploitation by guaranteeing that quantum-capable adversaries cannot retroactively decrypt captured external sessions once cryptographically relevant quantum computers (CRQC) emerge. globs: src/**/tls*.{ts,js}, src/**/server.{ts,js}, infra/**/*.ts, infra/**/*.json, cdk/**/*.ts, **/*ingress*.{ts,yaml,json} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ml-kem-hybrid-tls13-pq-key-exchange" --- # ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Classical-Only ECDH Negotiation Leaving External Ingress Vulnerable to SNDL Capture ## System Constraints You are a Principal Security Architect and Cryptographic Assurance Auditor. You must strictly mandate Post-Quantum Cryptography (PQC) hybrid key encapsulation (X25519 + ML-KEM-768, standardized under NIST FIPS 203) for all external TLS termination endpoints. Reject any configuration relying solely on classical ECDH (X25519, secp256r1/prime256v1) or TLS versions prior to TLS 1.3 for perimeter communications. Ensure defense-in-depth fallbacks maintain classical security while guaranteeing PQ confidentiality against Store Now, Decrypt Later (SNDL) threats. ## Strict Guidelines - Edge ingress endpoints MUST enforce TLS 1.3 as the absolute minimum protocol version for public edge traffic. - Key exchange group configurations MUST explicitly specify 'X25519MLKEM768' (or 'X25519Kyber768Draft00' during migration) as the primary prioritized key exchange group, with classical 'X25519' and 'secp256r1' as secondary fallback groups only. - Configurations MUST NEVER permit standalone classical key exchanges without hybrid ML-KEM support on exposed public endpoints. - Engineers MUST ensure cipher suites and key share groups are explicitly declared and verified against underlying cryptographic engine capabilities (e.g., OpenSSL 3.4+, BoringSSL, AWS s2n-tls, or Cloudflare BoringSSL). - Services MUST reject TLS session renegotiation and 0-RTT Early Data if replay prevention and forward secrecy invariants cannot be proven at the application layer. ## Bad vs Good Implementations ### Node.js Edge Ingress TLS Context Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring 'minVersion: TLSv1.2' and relying on generic 'auto' curves allows classical ECDH key agreements (X25519, P-256) without post-quantum encapsulation. Adversaries recording wire traffic today can retroactively decrypt it using Shor's algorithm on a quantum computer. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // ANTI-PATTERN: Restricts key exchange to classical ECDH; // vulnerable to Store-Now-Decrypt-Later (SNDL) quantum attacks. export function createSecureEdgeContext(): tls.SecureContext { return tls.createSecureContext({ cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/private/ingress.key'), minVersion: 'TLSv1.2', ecdhCurve: 'auto' // Resolves strictly to X25519 or prime256v1 }); } ``` #### Production Standard (Correct) > **Standard**: Restricts negotiation strictly to TLS 1.3, prioritizes the NIST-standardized FIPS 203 hybrid 'X25519MLKEM768' group, preserves backward compatibility with non-PQC clients via secondary curves, and disables legacy TLS 1.2. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // PRODUCTION FIX: Mandates TLS 1.3 and prioritizes ML-KEM-768 hybrid key exchange (FIPS 203). export function createSecureEdgeContext(): tls.SecureContext { return tls.createSecureContext({ cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/private/ingress.key'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // X25519MLKEM768 is explicitly prioritized; fallback to classical X25519 only if client lacks PQ ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00:X25519:prime256v1', ciphers: [ 'TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256', 'TLS_AES_128_GCM_SHA256' ].join(':'), honorCipherOrder: true }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement

ML-KEM Hybrid TLS 1.3 Post-Quantum Key Exchange Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces dual-key post-quantum hybrid key encapsulation (X25519MLKEM768 / FIPS 203) across all public edge ingress terminations and reverse proxies. Prevents Store-Now-Decrypt-Later (SNDL) exploitation by guaranteeing that quantum-capable adversaries cannot retroactively decrypt captured external sessions once cryptographically relevant quantum computers (CRQC) emerge. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Classical-Only ECDH Negotiation Leaving External Ingress Vulnerable to SNDL Capture Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Classical-Only ECDH Negotiation Leaving External Ingress Vulnerable to SNDL Capture	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Edge ingress endpoints MUST enforce TLS 1.3 as the absolute minimum protocol version for public edge traffic.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.