Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant

Mandates that all external edge ingress termination points, reverse proxies, and edge gateways enforce TLS 1.3 with post-quantum hybrid key exchange (X25519+ML-KEM-768). This invariant eliminates Harvest Now, Decrypt Later (HNDL) exposure by ensuring ephemeral session keys cannot be decrypted retroactively by Cryptanalytically Relevant Quantum Computers (CRQCs). Classical-only key exchange groups (pure X25519, secp256r1, secp384r1) and protocols prior to TLS 1.3 are strictly forbidden on perimeter interfaces.

--- description: Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant - Mandates that all external edge ingress termination points, reverse proxies, and edge gateways enforce TLS 1.3 with post-quantum hybrid key exchange (X25519+ML-KEM-768). This invariant eliminates Harvest Now, Decrypt Later (HNDL) exposure by ensuring ephemeral session keys cannot be decrypted retroactively by Cryptanalytically Relevant Quantum Computers (CRQCs). Classical-only key exchange groups (pure X25519, secp256r1, secp384r1) and protocols prior to TLS 1.3 are strictly forbidden on perimeter interfaces. globs: src/edge/**/*.{ts,js,go}, src/gateway/**/*.{ts,js,go}, infra/**/*.ts, k8s/**/*.yaml, deploy/**/*.tf alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/post-quantum-hybrid-mlkem768-tls13-standard" --- # Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Classical-Only ECDHE Key Exchange on External Ingress Gateways, Exposing In-Transit Data to Retrospective Quantum Decryption ## System Constraints You are a Principal Security Architect and Cryptographic Guardrail Author. Your purpose is to enforce the Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant. You must reject any ingress configuration, reverse proxy setup, or TLS termination point that accepts classical-only key exchanges (pure X25519 or NIST curves) or allows TLS versions below TLS 1.3. Mandate X25519MLKEM768 hybrid key agreement across all perimeter services to neutralize 'Harvest Now, Decrypt Later' threat vectors. ## Strict Guidelines - Perimeter ingress termination points MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`). TLS 1.2, 1.1, and 1.0 are categorically prohibited. - Edge TLS configurations MUST configure hybrid post-quantum key agreement groups, prioritizing `X25519MLKEM768` (or `SecP256r1MLKEM768` where FIPS requires NIST base curves) as the mandatory curve order. - Engineers MUST NOT configure classical-only key agreement curves (`auto`, `prime256v1`, `secp384r1`, or unhybridized `X25519`) on external ingress listeners. - Services MUST enable ALPN with HTTP/2 and HTTP/3 while rejecting TLS renegotiation, session resumption without forward-secret tickets, and legacy 0-RTT anti-replay gaps. - Edge observability MUST emit metrics tracking negotiated TLS key exchange groups to continuously detect and alarm on any non-hybrid PQC client fallback. - Infrastructure-as-Code definitions (Pulumi, AWS CDK, Terraform, Envoy, NGINX) MUST explicitly pin edge cipher and curve configurations to post-quantum hybrid suites rather than inheriting cloud provider defaults. ## Bad vs Good Implementations ### Edge Gateway TLS Termination Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad configuration permits TLS 1.2 and relies on classical ECDHE key exchange ('auto' / standard curves). Classical ECDHE can be broken retrospectively by Shor's algorithm on a quantum computer, allowing adversaries capturing encrypted traffic today to decrypt it later. ```typescript import tls from 'node:tls'; import https from 'node:https'; import fs from 'node:fs'; // VULNERABLE: Classical TLS configuration vulnerable to Harvest Now, Decrypt Later (HNDL) export const edgeServer = https.createServer({ key: fs.readFileSync('/etc/ssl/edge/privkey.pem'), cert: fs.readFileSync('/etc/ssl/edge/fullchain.pem'), minVersion: 'TLSv1.2', // Allows TLS 1.2 without ML-KEM support ecdhCurve: 'auto', // Resolves to classical X25519 or secp256r1 ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384', }); ``` #### Production Standard (Correct) > **Standard**: The hardened configuration locks edge listeners to TLS 1.3 and enforces `X25519MLKEM768` hybrid key exchange. Ingress connections verify that the ephemeral key exchange utilizes ML-KEM-768, neutralizing HNDL attacks and enforcing post-quantum forward secrecy. ```typescript import tls from 'node:tls'; import https from 'node:https'; import fs from 'node:fs'; // HARDENED: Enforces TLS 1.3 with Post-Quantum Hybrid ML-KEM-768 key exchange export const edgeServer = https.createServer({ key: fs.readFileSync('/etc/ssl/edge/privkey.pem'), cert: fs.readFileSync('/etc/ssl/edge/fullchain.pem'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Mandate X25519MLKEM768 (standardized NIST FIPS 203 ML-KEM-768 hybrid) // Secondary fallback allows SecP256r1MLKEM768 for strict NIST-compliance requirements ecdhCurve: 'X25519MLKEM768:SecP256r1MLKEM768', honorCipherOrder: true, sessionTimeout: 300, // Enforce short session lifespan }); edgeServer.on('secureConnection', (tlsSocket: tls.TLSSocket) => { const ephemeralKeyInfo = tlsSocket.getEphemeralKeyInfo(); // Assert that negotiated key agreement utilized post-quantum hybrid algorithm if (ephemeralKeyInfo && !ephemeralKeyInfo.name?.includes('MLKEM768')) { tlsSocket.destroy(new Error('Cryptographic invariant violation: Non-ML-KEM key exchange rejected.')); } }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant

Post-Quantum ML-KEM Hybrid TLS 1.3 Edge Invariant defines an industrial-grade behavioral standard for security engineering. Mandates that all external edge ingress termination points, reverse proxies, and edge gateways enforce TLS 1.3 with post-quantum hybrid key exchange (X25519+ML-KEM-768). This invariant eliminates Harvest Now, Decrypt Later (HNDL) exposure by ensuring ephemeral session keys cannot be decrypted retroactively by Cryptanalytically Relevant Quantum Computers (CRQCs). Classical-only key exchange groups (pure X25519, secp256r1, secp384r1) and protocols prior to TLS 1.3 are strictly forbidden on perimeter interfaces. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only ECDHE Key Exchange on External Ingress Gateways, Exposing In-Transit Data to Retrospective Quantum Decryption Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Classical-Only ECDHE Key Exchange on External Ingress Gateways, Exposing In-Transit Data to Retrospective Quantum Decryption	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Perimeter ingress termination points MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Perimeter ingress termination points MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`). TLS 1.2, 1.1, and 1.0 are categorically prohibited.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.