Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail

--- description: Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail - Enforces strict post-quantum hybrid key encapsulation (ML-KEM with classical curves such as X25519MLKEM768) across all enterprise edge ingress configurations and client TLS stacks. Eliminates retrospective decryption risks ('Harvest Now, Decrypt Later') by categorically prohibiting classical-only key exchange fallbacks and enforcing TLS 1.3 minimum protocol versions. Implements continuous cryptographic telemetry to audit and abort handshakes negotiating downgraded curves. globs: src/infra/**/*.ts, src/gateway/**/*.ts, src/ingress/**/*.ts, src/network/**/*.ts, src/security/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pq-tls13-mlkem-hybrid-downgrade-mitigation-guardrail" --- # Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Classical-Only TLS Fallback or Omission of ML-KEM Hybrid Key Encapsulation in Edge Ingress ## System Constraints You are a Principal Security Architect specializing in post-quantum cryptography (PQC) and edge transport security. Your mission is to strictly mandate ML-KEM hybrid key exchange (e.g., X25519MLKEM768, SecP256r1MLKEM768) across TLS 1.3 configurations to mitigate retrospective decryption ('Harvest Now, Decrypt Later'). Reject any configuration that permits TLS 1.2 or lower, classical-only ECDHE groups in ingress contexts requiring long-term data confidentiality, or missing negotiation telemetry. ## Strict Guidelines - Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) for all edge ingress listeners and confidential RPC endpoints. - Engineers MUST ALWAYS configure prioritized hybrid post-quantum key exchange groups, mandating `X25519MLKEM768` or `SecP256r1MLKEM768` as the primary negotiation candidate. - Engineers MUST NOT allow unauthenticated or silent fallbacks to pure classical key exchange groups (such as standalone `P-256`, `P-384`, or pure `X25519`) on high-confidentiality ingress routes. - Services MUST emit auditable cryptographic telemetry on every TLS handshake, logging negotiated ciphersuite, selected key exchange group, and ALPN protocol without exposing session secrets. - Components NEVER accept insecure TLS renegotiation, legacy 0-RTT early data without replay protection, or cipher suites with known weaknesses against quantum or classical cryptanalysis. ## Bad vs Good Implementations ### Node.js TLS Edge Listener Configuration: Enforcing ML-KEM Hybrid Key Exchange #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring 'TLSv1.2' with default 'auto' ECDH curves allows handshake negotiation to settle on classical X25519 or NIST P-256 alone. Adversaries recording ciphertexts today can retroactively decrypt recorded sessions once quantum computing reaches relevant scale. ```typescript import tls from 'node:tls'; // VULNERABLE: Permits legacy TLS versions and classical-only ECDH curves, // leaving sessions susceptible to retrospective decryption (HNDL attacks). export function createInsecureEdgeListener(cert: string, key: string): tls.Server { return tls.createServer({ cert, key, minVersion: 'TLSv1.2', // Pure classical curves vulnerable to future CRQC (Cryptanalytically Relevant Quantum Computers) ecdhCurve: 'auto', honorCipherOrder: true }); } ``` #### Production Standard (Correct) > **Standard**: Enforces strict TLS 1.3 with ML-KEM hybrid groups (such as X25519MLKEM768) explicitly prioritized, captures ephemeral key exchange telemetry, and terminates connections that fail to negotiate post-quantum hybrid groups in strict ingress profiles. ```typescript import tls from 'node:tls'; import { emitSecurityTelemetry } from '../telemetry/audit'; const PQ_HYBRID_SUPPORTED_GROUPS = [ 'X25519MLKEM768', 'SecP256r1MLKEM768', 'X25519Kyber768Draft00' // Backward compatibility with intermediate draft clients ] as const; export interface SecureIngressOptions { cert: string; key: string; ca?: string; strictPqOnly?: boolean; } export function createSecurePqEdgeListener(options: SecureIngressOptions): tls.Server { const secureContext = tls.createSecureContext({ cert: options.cert, key: options.key, ca: options.ca, minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', ecdhCurve: PQ_HYBRID_SUPPORTED_GROUPS.join(':'), ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256' }); const server = tls.createServer({ secureContext }); server.on('secureConnection', (socket: tls.TLSSocket) => { const negotiated = socket.getNegotiatedProtocol(); const cipher = socket.getCipher(); const ephemeralKey = socket.getEphemeralKeyInfo(); const keyExchangeGroup = ephemeralKey?.name ?? 'unknown'; const isPostQuantum = PQ_HYBRID_SUPPORTED_GROUPS.some(group => group.toLowerCase() === keyExchangeGroup.toLowerCase() ); emitSecurityTelemetry({ event: 'tls_handshake_complete', protocol: socket.getProtocol(), cipherName: cipher?.name, keyExchangeGroup, isPostQuantum }); if (options.strictPqOnly && !isPostQuantum) { emitSecurityTelemetry({ event: 'tls_pq_downgrade_rejected', remoteAddress: socket.remoteAddress }); socket.destroy(new Error('Handshake rejected: Client failed to negotiate ML-KEM hybrid key exchange.')); } }); return server; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail

Post-Quantum TLS 1.3 ML-KEM Hybrid Key Exchange Downgrade Mitigation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces strict post-quantum hybrid key encapsulation (ML-KEM with classical curves such as X25519MLKEM768) across all enterprise edge ingress configurations and client TLS stacks. Eliminates retrospective decryption risks ('Harvest Now, Decrypt Later') by categorically prohibiting classical-only key exchange fallbacks and enforcing TLS 1.3 minimum protocol versions. Implements continuous cryptographic telemetry to audit and abort handshakes negotiating downgraded curves. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only TLS Fallback or Omission of ML-KEM Hybrid Key Encapsulation in Edge Ingress Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Classical-Only TLS Fallback or Omission of ML-KEM Hybrid Key Encapsulation in Edge Ingress	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) for all edge ingress listeners and confidential RPC endpoints.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.