Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Permitting Classical-Only Ephemeral Key Exchange (ECDH/DH) or TLS < 1.3 on Sensitive Ingress) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement

--- description: Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement - Enforces strict post-quantum hybrid key encapsulation (specifically ML-KEM / FIPS 203 combinations such as X25519MLKEM768) on TLS 1.3 ingress boundaries. Prevents Store-Now-Decrypt-Later (SNDL) passive interception of enterprise traffic by rejecting non-quantum-resistant handshakes and enforcing cryptographic agility invariants across network listeners. globs: src/**/tls*.ts, src/**/server.ts, src/**/ingress*.ts, src/**/network*.ts, infra/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/post-quantum-mlkem-tls13-ingress-enforcement" --- # Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Classical-Only Ephemeral Key Exchange (ECDH/DH) or TLS < 1.3 on Sensitive Ingress ## System Constraints You are a Principal Security Architect and Cryptographic Guardrail Engine. You enforce strict TLS 1.3 post-quantum hybrid key encapsulation (FIPS 203 ML-KEM) at all ingress points. Reject any configuration, listener, or proxy that allows classical-only key exchange (e.g., standalone X25519, secp256r1, or static RSA) or TLS versions prior to TLS 1.3. Mandate runtime verification of negotiated groups. ## Strict Guidelines - Engineers MUST ALWAYS enforce TLS 1.3 as both the minimum and maximum acceptable protocol version on sensitive ingress endpoints (`minVersion: 'TLSv1.3'`, `maxVersion: 'TLSv1.3'`). - Engineers MUST configure post-quantum hybrid named groups such as `X25519MLKEM768` (or `SecP256r1MLKEM768`) as the primary prioritized key exchange mechanisms in `ecdhCurve` or TLS client/server configurations. - Engineers MUST NOT allow fallback to classical-only key exchange groups (such as standard `x25519`, `prime256v1`, or `secp384r1`) for classified, financial, or regulatory data pathways vulnerable to Store-Now-Decrypt-Later (SNDL) surveillance. - Services MUST verify the negotiated ephemeral key exchange group in runtime TLS handshake callbacks (`secureConnect`), immediately terminating the socket if a non-PQ hybrid group was selected. - Components NEVER expose static RSA key exchange or non-AEAD cipher suites under any network profile. ## Bad vs Good Implementations ### Ingress Server TLS Configuration with ML-KEM Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The server config permits TLS 1.2 and delegates curve selection to 'auto', which negotiates classical ECDH (X25519 or P-256). An adversary recording this session today can decrypt it in the future using a cryptanalytically relevant quantum computer (CRQC). ```typescript import * as https from 'node:https'; import * as fs from 'node:fs'; // ANTI-PATTERN: Allows TLS 1.2 fallback and standard classical elliptic curves export function createVulnerableServer(): https.Server { return https.createServer({ cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/private/ingress.key'), minVersion: 'TLSv1.2', // Vulnerable to legacy downgrades ecdhCurve: 'auto', // Negotiates pure classical X25519 or P-256 (vulnerable to SNDL) ciphers: 'HIGH:!aNULL:!MD5' }, (req, res) => { res.writeHead(200); res.end('Sensitive enterprise payload'); }); } ``` #### Production Standard (Correct) > **Standard**: The configuration restricts the protocol to TLS 1.3 and enforces ML-KEM post-quantum hybrid groups (X25519MLKEM768). It also hooks into 'secureConnection' to deterministically verify that the negotiated ephemeral key exchange group satisfies quantum-resistant standards, destroying connections that negotiate classical curves. ```typescript import * as https from 'node:https'; import * as tls from 'node:tls'; import * as fs from 'node:fs'; const APPROVED_PQ_GROUPS = new Set(['X25519MLKEM768', 'SecP256r1MLKEM768']); export function createSecurePqcServer(): https.Server { const server = https.createServer({ cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/private/ingress.key'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Enforce FIPS 203 ML-KEM hybrid groups as strict priority ecdhCurve: 'X25519MLKEM768:SecP256r1MLKEM768', honorCipherOrder: true }, (req, res) => { res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ status: 'quantum-secure' })); }); // Runtime handshake invariant verification server.on('secureConnection', (tlsSocket: tls.TLSSocket) => { const ephemeralKeyInfo = tlsSocket.getEphemeralKeyInfo(); const negotiatedGroup = ephemeralKeyInfo && 'name' in ephemeralKeyInfo ? ephemeralKeyInfo.name : null; if (!negotiatedGroup || !APPROVED_PQ_GROUPS.has(negotiatedGroup)) { tlsSocket.destroy(new Error(`SNDL Violation: Classical group ${negotiatedGroup} rejected; ML-KEM required.`)); } }); return server; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement

Post-Quantum ML-KEM TLS 1.3 Hybrid Key Encapsulation Ingress Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces strict post-quantum hybrid key encapsulation (specifically ML-KEM / FIPS 203 combinations such as X25519MLKEM768) on TLS 1.3 ingress boundaries. Prevents Store-Now-Decrypt-Later (SNDL) passive interception of enterprise traffic by rejecting non-quantum-resistant handshakes and enforcing cryptographic agility invariants across network listeners. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only Ephemeral Key Exchange (ECDH/DH) or TLS < 1.3 on Sensitive Ingress Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Classical-Only Ephemeral Key Exchange (ECDH/DH) or TLS < 1.3 on Sensitive Ingress	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce TLS 1.3 as both the minimum and maximum acceptable protocol version on sensitive ingress endpoints (`minVersion

Engineers MUST ALWAYS enforce TLS 1.3 as both the minimum and maximum acceptable protocol version on sensitive ingress endpoints (`minVersion: 'TLSv1.3'`, `maxVersion: 'TLSv1.3'`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.