Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense

--- description: Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense - Enforces strict client-to-edge cryptographic negotiation invariants combining X25519 with ML-KEM-768 (X25519MLKEM768) over TLS 1.3 to mitigate Store-Now-Decrypt-Later (SNDL) adversary strategies. Mandates deterministic aborts on cryptographic downgrade attempts, disallows non-hybrid key exchange fallbacks in designated zero-trust zones, and requires strict verification of negotiated supported_groups extensions. globs: src/network/**/*.{ts,js}, src/security/**/*.{ts,js}, src/infra/**/*.{ts,js}, src/edge/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/post-quantum-hybrid-tls-mlkem-downgrade-guardrail" --- # Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Classical-Only Fallbacks or Unchecked Key Share Downgrades During TLS 1.3 Handshake Negotiation ## System Constraints You are a Principal Security Architect enforcing Post-Quantum Hybrid TLS 1.3 ML-KEM Downgrade Prevention. Mandate that all egress connections, client configurations, and edge terminators enforce X25519MLKEM768 (or approved hybrid Kyber drafts) without permitting runtime fallbacks to legacy classical-only key exchanges. Prohibit non-TLS-1.3 configurations and enforce explicit handshake verification hooks to terminate connections if the negotiated group degrades below post-quantum security requirements. ## Strict Guidelines - Engineers MUST ALWAYS enforce TLS 1.3 as the minimum and maximum permitted protocol version when establishing secure perimeter sessions. - Engineers MUST configure 'X25519MLKEM768' as the primary and non-negotiable supported key exchange group in high-security zones. - Engineers MUST NOT allow automated fallback loops to pure ECDH (e.g., X25519, secp256r1) upon handshake failure without generating a critical security audit event and deliberate human intervention. - Services MUST verify the selected key exchange group on the established TLS socket during post-handshake hooks and terminate the connection immediately if the hybrid algorithm is absent. - Components NEVER accept TLS configurations containing cipher suites or key exchange extensions vulnerable to Store-Now-Decrypt-Later (SNDL) attacks in post-quantum mandatory zones. ## Bad vs Good Implementations ### Enforcing Hybrid ML-KEM-768 Key Exchange and Handshake Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring 'ecdhCurve: auto' with 'minVersion: TLSv1.2' allows an active on-path adversary or non-compliant middlebox to downgrade the session to pure classical ECDH or legacy TLS 1.2, exposing stored ciphertext to post-quantum cryptanalysis (SNDL). ```typescript import * as tls from 'node:tls'; // ANTI-PATTERN: Allows legacy TLS versions and falls back to pure classical ECDH export function createSecureClientSocket(host: string, port: number): tls.TLSSocket { return tls.connect({ host, port, // Fallback allows MITM or legacy server to negotiate classical ECDH without PQ security minVersion: 'TLSv1.2', ecdhCurve: 'auto' }); } ``` #### Production Standard (Correct) > **Standard**: Restricts the protocol strictly to TLS 1.3, mandates the 'X25519MLKEM768' hybrid key exchange curve, and incorporates a post-handshake invariant check that destroys the socket if the negotiated group deviates from the mandated hybrid scheme. ```typescript import * as tls from 'node:tls'; const PQ_HYBRID_GROUP = 'X25519MLKEM768'; export function createSecureClientSocket(host: string, port: number): Promise<tls.TLSSocket> { return new Promise((resolve, reject) => { const socket = tls.connect({ host, port, minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', ecdhCurve: PQ_HYBRID_GROUP, rejectUnauthorized: true }); socket.once('secureConnect', () => { // Invariant: Verify the negotiated ephemeral key exchange group explicitly const negotiatedGroup = (socket as tls.TLSSocket & { getNegotiatedGroup?: () => string }).getNegotiatedGroup?.(); if (negotiatedGroup && negotiatedGroup !== PQ_HYBRID_GROUP) { socket.destroy(new Error(`Downgrade detected: Negotiated group ${negotiatedGroup} violates PQ invariant.`)); return reject(new Error('Cryptographic downgrade violation: Session aborted.')); } resolve(socket); }); socket.once('error', (err) => reject(err)); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense

Mandatory Post-Quantum Hybrid TLS 1.3 ML-KEM-768 Negotiation and Downgrade Defense defines an industrial-grade behavioral standard for security engineering. Enforces strict client-to-edge cryptographic negotiation invariants combining X25519 with ML-KEM-768 (X25519MLKEM768) over TLS 1.3 to mitigate Store-Now-Decrypt-Later (SNDL) adversary strategies. Mandates deterministic aborts on cryptographic downgrade attempts, disallows non-hybrid key exchange fallbacks in designated zero-trust zones, and requires strict verification of negotiated supported_groups extensions. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only Fallbacks or Unchecked Key Share Downgrades During TLS 1.3 Handshake Negotiation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Classical-Only Fallbacks or Unchecked Key Share Downgrades During TLS 1.3 Handshake Negotiation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce TLS 1.3 as the minimum and maximum permitted protocol version when establishing secure perimeter sessions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.