Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant

--- description: Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant - Enforces mandatory dual classical and post-quantum hybrid key encapsulation (X25519MLKEM768 or X25519Kyber768Draft00) across all public-facing reverse proxies and edge ingress endpoints. Mitigates Store-Now-Decrypt-Later (SNDL) attacks by guaranteeing TLS 1.3 sessions are protected against future cryptanalytically relevant quantum computers while maintaining backward compatibility with legacy clients. globs: infra/**/*.ts, src/edge/**/*.{ts,js}, deploy/**/*.ts, k8s/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pq-tls-mlkem-hybrid-key-exchange-edge-invariant" --- # Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying Classical-Only ECDH Key Exchanges on Public Edge Terminations Susceptible to SNDL Harvesting ## System Constraints You are a Principal Security Architect enforcing Post-Quantum Cryptography (PQC) transport standards. You must mandate hybrid key exchange protocols (X25519 + ML-KEM-768) on all ingress proxy definitions, edge gateways, and TLS termination contexts. Strictly reject classical-only ECDHE suites on public endpoints to neutralize 'Store-Now-Decrypt-Later' threat actors. ## Strict Guidelines - Edge proxies MUST terminate TLS with TLS 1.3 as the strict minimum protocol version for high-value external endpoints. - Key exchange groups MUST prioritize hybrid post-quantum groups (specifically `X25519MLKEM768` or `X25519Kyber768Draft00`) ahead of classical curves (`X25519`, `secp256r1`). - Engineers MUST NOT disable TLS 1.3 hybrid KEM negotiation or hardcode legacy cipher suites that bypass ML-KEM key encapsulation. - Public infrastructure code MUST explicitly declare support for NIST FIPS 203 ML-KEM parameters at the edge routing layer. - Edge configurations SHOULD monitor and emit telemetry for `ssl_curve` or `key_exchange_group` to detect client fallbacks to non-PQ classical suites. ## Bad vs Good Implementations ### Envoy Ingress Gateway TLS Configuration (TypeScript IaC) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This configuration permits TLS 1.2 and restricts ECDH curves exclusively to classical X25519 and NIST P-256. Adversaries harvesting current transport traffic can record ciphertexts today and decrypt them once a cryptanalytically relevant quantum computer (CRQC) becomes available. ```typescript import { Construct } from 'constructs'; export function createEdgeTlsContext(scope: Construct) { // ANTI-PATTERN: Restricting curves to legacy classical ECDHE; // completely vulnerable to Store-Now-Decrypt-Later (SNDL) attacks. return { commonTlsContext: { tlsParams: { tlsMinimumProtocolVersion: 'TLSv1_2', tlsMaximumProtocolVersion: 'TLSv1_3', ecdhCurves: ['X25519', 'P-256'], cipherSuites: [ 'ECDHE-ECDSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES128-GCM-SHA256' ] } } }; } ``` #### Production Standard (Correct) > **Standard**: Enforces TLS 1.3 and configures hybrid ML-KEM-768 key exchanges with classical X25519 redundancy. This guarantees that traffic captured by quantum-capable adversaries cannot be decrypted retroactively while maintaining compatibility with legacy classical clients. ```typescript import { Construct } from 'constructs'; export function createEdgeTlsContext(scope: Construct) { // SECURE: Enforces TLS 1.3 minimum and prepends ML-KEM-768 hybrid // key encapsulation mechanisms (X25519MLKEM768 / X25519Kyber768Draft00). return { commonTlsContext: { tlsParams: { tlsMinimumProtocolVersion: 'TLSv1_3', tlsMaximumProtocolVersion: 'TLSv1_3', // X25519MLKEM768 (standardized NIST FIPS 203) with fallback for older draft clients ecdhCurves: [ 'X25519MLKEM768', 'X25519Kyber768Draft00', 'X25519', // Classical fallback only when client lacks PQ support 'P-256' ], cipherSuites: [ 'TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256', 'TLS_AES_128_GCM_SHA256' ] } } }; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant

Post-Quantum TLS 1.3 ML-KEM (Kyber) Hybrid Key Exchange Edge Invariant defines an industrial-grade behavioral standard for security engineering. Enforces mandatory dual classical and post-quantum hybrid key encapsulation (X25519MLKEM768 or X25519Kyber768Draft00) across all public-facing reverse proxies and edge ingress endpoints. Mitigates Store-Now-Decrypt-Later (SNDL) attacks by guaranteeing TLS 1.3 sessions are protected against future cryptanalytically relevant quantum computers while maintaining backward compatibility with legacy clients. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Classical-Only ECDH Key Exchanges on Public Edge Terminations Susceptible to SNDL Harvesting Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Classical-Only ECDH Key Exchanges on Public Edge Terminations Susceptible to SNDL Harvesting	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Edge proxies MUST terminate TLS with TLS 1.3 as the strict minimum protocol version for high-value external endpoints.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.