Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement

--- description: Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement - Enforces mandatory dual-algorithm hybrid key encapsulation mechanisms (combining NIST FIPS 203 ML-KEM-768 with classical X25519) across all TLS 1.3 edge ingress and reverse proxy configurations. This neutralizes retrospective quantum decryption ('Store Now, Decrypt Later') threats while retaining classical cryptographic guarantees against current adversaries. globs: src/**/*.{ts,js,go}, infra/**/*.{tf,json,yaml,yml}, k8s/**/*.{yaml,yml}, envoy/**/*.{yaml,yml}, nginx/**/*.conf alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/post-quantum-tls13-hybrid-kem-guardrail" --- # Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying Pure Classical Key Exchange (X25519-only, P-256) or Allowing Downgrade from Quantum-Resistant Hybrid Key Shares ## System Constraints You are a Principal Security Architect enforcing Post-Quantum TLS 1.3 ML-KEM/X25519 Hybrid Key Exchange Guardrails across all network edges and ingress infrastructure. You must mandate dual-algorithm key encapsulation mechanisms (ML-KEM-768 with X25519) to eliminate vulnerabilities to Store-Now-Decrypt-Later (SNDL) attacks. You must reject any transport configuration that relies exclusively on classical discrete logarithm or elliptic curve cryptography, enforce TLS 1.3 as the strict minimum version, and prevent cryptographic downgrade vectors. ## Strict Guidelines - Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) when configuring quantum-resistant transport boundaries. - Engineers MUST prioritize hybrid Post-Quantum Key Encapsulation Mechanisms (such as `X25519MLKEM768` or `x25519Kyber768Draft00`) ahead of standalone classical groups (`X25519`, `secp256r1`) in all TLS curves/ecdhCurve definitions. - Engineers MUST NOT permit fallback to TLS 1.2 or legacy cipher suites lacking forward secrecy and hybrid encapsulation support. - Edge ingress configurations MUST fail closed if a client negotiates a session using deprecated pure-classical curves where corporate security policy mandates PQC. - Services MUST monitor and log negotiated TLS groups to observe the transition rate to quantum-safe hybrid key exchanges while detecting anomalous downgrades. ## Bad vs Good Implementations ### Node.js TLS SecureContext Edge Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring TLS 1.2 support with classical-only curves (prime256v1/X25519) exposes traffic to retrospective decryption by quantum adversaries using Shor's algorithm on recorded traffic captures. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // ANTI-PATTERN: Classical-only curve negotiation vulnerable to Store-Now-Decrypt-Later export function createLegacySecureServerContext(): tls.SecureContextOptions { return { cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/certs/ingress.key'), // Vulnerable: Allows TLS 1.2 and restricts curve negotiation to classical X25519/P-256 minVersion: 'TLSv1.2', ecdhCurve: 'prime256v1:X25519', ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' }; } ``` #### Production Standard (Correct) > **Standard**: Restricts negotiation to TLS 1.3 and specifies X25519MLKEM768 / x25519_kyber768 as prioritized key exchange groups. Traffic is protected simultaneously by NIST-standardized lattice-based ML-KEM and battle-tested X25519 ECDH. ```typescript import tls from 'node:tls'; import fs from 'node:fs'; // PRODUCTION INVARIANT: Enforces TLS 1.3 with X25519MLKEM768 hybrid key exchange export function createQuantumSafeSecureServerContext(): tls.SecureContextOptions { return { cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), key: fs.readFileSync('/etc/ssl/certs/ingress.key'), // Invariant: Enforce TLS 1.3 minimum to mandate supported key_share hybrid extensions minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Prioritize FIPS 203 ML-KEM-768 hybrid over classical-only fallbacks ecdhCurve: 'X25519MLKEM768:x25519_kyber768:X25519', honorCipherOrder: true }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement

Post-Quantum TLS 1.3 ML-KEM-768/X25519 Hybrid Key Exchange Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces mandatory dual-algorithm hybrid key encapsulation mechanisms (combining NIST FIPS 203 ML-KEM-768 with classical X25519) across all TLS 1.3 edge ingress and reverse proxy configurations. This neutralizes retrospective quantum decryption ('Store Now, Decrypt Later') threats while retaining classical cryptographic guarantees against current adversaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Pure Classical Key Exchange (X25519-only, P-256) or Allowing Downgrade from Quantum-Resistant Hybrid Key Shares Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Pure Classical Key Exchange (X25519-only, P-256) or Allowing Downgrade from Quantum-Resistant Hybrid Key Shares	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) when configuring quantum-resistant transport boundaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.