Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations

--- description: Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations - Enforces hybrid post-quantum key encapsulation mechanism (X25519MLKEM768 / Kyber768 hybrid) on all TLS 1.3 edge ingress and internal service mesh termination endpoints. Prevents harvest-now-decrypt-later (HNDL) attacks by quantum-adversaries while maintaining classical elliptic curve fallback robustness across edge listeners and downstream clients. Restricts cryptographic cipher suites exclusively to TLS 1.3 primitives and mandates post-quantum curve negotiation ordering. globs: infra/**/*.ts, src/gateway/**/*.ts, src/network/**/*.ts, src/infra/**/*.ts, lib/security/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/mlkem-hybrid-pqc-tls13-key-exchange-invariant" --- # Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Classical-Only Curve Selection or Insecure TLS Protocol Fallback Permitting Harvest-Now-Decrypt-Later Interception ## System Constraints You are a Principal Security Architect enforcing the ML-KEM Hybrid Post-Quantum TLS 1.3 Key Exchange Invariant. Mandate that all TLS context configurations, API gateway edge listeners, and reverse proxy definitions explicitly enforce TLS 1.3 minimum versions with X25519MLKEM768 hybrid key agreement groups as the primary preference. Reject any configuration allowing classical-only key exchange, TLS 1.2 or lower, or unpinned cipher negotiations. ## Strict Guidelines - Engineers MUST ALWAYS configure `minVersion: 'TLSv1.3'` across all TLS listener options and TLS contexts. - Engineers MUST ALWAYS prioritize `X25519MLKEM768` (or `X25519Kyber768Draft00`) followed by `X25519` in the `ecdhCurve` or named groups parameter. - Engineers MUST NOT permit fallback to TLS 1.2, RSA key exchanges, or non-PQC curve configurations in ingress termination configurations. - Services MUST emit metrics and alerts when incoming TLS handshakes fail post-quantum group negotiation. - Components NEVER use default unpinned `tls.createServer()` or generic SSL contexts without explicit hybrid post-quantum curve constraints. ## Bad vs Good Implementations ### Edge Ingress TLS 1.3 Hybrid Key Exchange Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configures TLS 1.2 as minimum version, relies on classical-only ECDHE with legacy ciphers, and omits ML-KEM-768 hybrid key agreement, exposing traffic to Harvest-Now-Decrypt-Later decryption by future quantum systems. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // VULNERABLE: Permits classical-only ECDHE without PQC hybrid encapsulation. // Allows TLS 1.2 negotiation susceptible to Harvest-Now-Decrypt-Later attacks. export function createEdgeServer(handler: (req: any, res: any) => void) { return tls.createServer({ key: fs.readFileSync('/etc/ssl/certs/ingress.key'), cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), minVersion: 'TLSv1.2', ciphers: 'ECDHE-RSA-AES256-GCM-SHA384:HIGH:!aNULL:!MD5' }, handler); } ``` #### Production Standard (Correct) > **Standard**: Pins the TLS protocol strictly to TLSv1.3, sets ecdhCurve to negotiate hybrid ML-KEM-768 groups ahead of classical curves, and restricts ciphers to AEAD-only suites, effectively mitigating HNDL risks. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // SECURE: Enforces strict TLS 1.3 with X25519MLKEM768 hybrid post-quantum key exchange. export function createEdgeServer(handler: (req: any, res: any) => void): tls.Server { const secureContextOptions: tls.TlsOptions = { key: fs.readFileSync('/etc/ssl/certs/ingress.key'), cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Prioritize ML-KEM-768 hybrid over classical curves (OpenSSL 3.3+ / BoringSSL format) ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00:X25519:P-256', ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256', honorCipherOrder: true }; return tls.createServer(secureContextOptions, handler); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations

Mandatory ML-KEM-768 Hybrid Post-Quantum Key Exchange for TLS 1.3 Ingress Terminations defines an industrial-grade behavioral standard for security engineering. Enforces hybrid post-quantum key encapsulation mechanism (X25519MLKEM768 / Kyber768 hybrid) on all TLS 1.3 edge ingress and internal service mesh termination endpoints. Prevents harvest-now-decrypt-later (HNDL) attacks by quantum-adversaries while maintaining classical elliptic curve fallback robustness across edge listeners and downstream clients. Restricts cryptographic cipher suites exclusively to TLS 1.3 primitives and mandates post-quantum curve negotiation ordering. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Classical-Only Curve Selection or Insecure TLS Protocol Fallback Permitting Harvest-Now-Decrypt-Later Interception Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Classical-Only Curve Selection or Insecure TLS Protocol Fallback Permitting Harvest-Now-Decrypt-Later Interception	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `minVersion

Engineers MUST ALWAYS configure `minVersion: 'TLSv1.3'` across all TLS listener options and TLS contexts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.