Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant

--- description: Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant - Enforces quantum-resilient hybrid key exchange mechanisms (specifically X25519MLKEM768 or SecP256r1MLKEM768) under TLS 1.3 across all perimeter ingress gateways, service mesh proxies, and internal microservice transports. Eliminates pure classical key exchange (standard ECDH/DH) to neutralize 'harvest now, decrypt later' (HNDL) adversaries intercepting enterprise data with multi-decade confidentiality requirements. globs: infra/**/*.{tf,yaml,yml,json}, **/envoy*.{yaml,yml}, **/ingress*.{yaml,yml}, src/**/tls*.{ts,js,go}, src/**/server.{ts,js,go} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/post-quantum-tls13-ml-kem-hybrid-invariant" --- # Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Pure Classical TLS Key Exchanges Vulnerable to Harvest-Now-Decrypt-Later Cryptanalysis ## System Constraints You are a Principal Security Architect enforcing the Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant. You must reject any transport layer configuration, ingress definition, Envoy filter, reverse proxy, or HTTP client/server bootstrapping that allows TLS versions prior to 1.3 or fails to mandate quantum-resistant hybrid KEM groups (such as X25519MLKEM768 or SecP256r1MLKEM768). Ensure strict cryptographic posture to eliminate Harvest Now, Decrypt Later (HNDL) exposure. ## Strict Guidelines - Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`); TLS 1.2 and lower MUST NOT be permitted under any condition. - Engineers MUST ALWAYS configure ML-KEM hybrid key exchange groups (such as `X25519MLKEM768` or `SecP256r1MLKEM768`) at the highest priority in the supported groups negotiation list. - Engineers MUST NOT allow pure classical curves (`X25519`, `prime256v1`, `secp384r1`) as standalone allowed groups without hybrid post-quantum encapsulation enabled. - Ingress controllers, API gateways, and service mesh definitions (Envoy, Istio, Traefik, CloudFront) MUST mandate hybrid KEM ciphersuites and reject non-PQC handshakes across all tenant boundaries. - Code SHOULD verify that client hello extensions negotiate hybrid ML-KEM groups and emit high-priority audit telemetry upon detecting classical-only negotiation attempts. ## Bad vs Good Implementations ### Node.js TLS/HTTPS Server Secure Context Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring TLS 1.2 with classical ECDHE key agreement exposes communication to immediate passive capture and retrospective decryption once cryptanalytically relevant quantum computers (CRQCs) become viable. ```typescript import https from 'node:https'; import fs from 'node:fs'; // ANTI-PATTERN: Allows classical TLS 1.2 fallback and standard ECDH curves // Vulnerable to Harvest Now, Decrypt Later (HNDL) quantum cryptanalysis const server = https.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.2', ciphers: 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256', ecdhCurve: 'auto' }, (req, res) => { res.writeHead(200); res.end('Vulnerable Session'); }); ``` #### Production Standard (Correct) > **Standard**: Enforces strict TLS 1.3 with X25519MLKEM768 hybrid key encapsulation, verifying the active ephemeral key exchange to guarantee immunity against quantum retrospective decryption. ```typescript import https from 'node:https'; import fs from 'node:fs'; import tls from 'node:tls'; // INVARIANT: TLS 1.3 strict enforcement with ML-KEM-768 hybrid key exchange const server = https.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Mandate X25519MLKEM768 hybrid KEM (FIPS 203 standardized) ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00', honorCipherOrder: true }, (req, res) => { const socket = req.socket as tls.TLSSocket; const ephemeralKeyInfo = socket.getEphemeralKeyInfo(); if (!ephemeralKeyInfo || !ephemeralKeyInfo.name?.includes('MLKEM')) { // Terminate connections that bypassed hybrid KEM negotiation socket.destroy(new Error('Security Invariant Violation: Non-PQC KEM handshake detected')); return; } res.writeHead(200); res.end('Quantum-Resilient Session'); }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant

Mandatory Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Invariant defines an industrial-grade behavioral standard for security engineering. Enforces quantum-resilient hybrid key exchange mechanisms (specifically X25519MLKEM768 or SecP256r1MLKEM768) under TLS 1.3 across all perimeter ingress gateways, service mesh proxies, and internal microservice transports. Eliminates pure classical key exchange (standard ECDH/DH) to neutralize 'harvest now, decrypt later' (HNDL) adversaries intercepting enterprise data with multi-decade confidentiality requirements. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Pure Classical TLS Key Exchanges Vulnerable to Harvest-Now-Decrypt-Later Cryptanalysis Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Pure Classical TLS Key Exchanges Vulnerable to Harvest-Now-Decrypt-Later Cryptanalysis	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`); TLS 1.2 and lower MUST NOT be permitted under any condition.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.