Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail

--- description: Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail - Enforces post-quantum hybrid key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) on all public ingress termination points and API gateways to neutralize 'Harvest Now, Decrypt Later' (HNDL) adversary campaigns. Requires strict TLS 1.3 minimum versions, explicit quantum-safe elliptic curve and KEM preferences, and rejection of legacy cipher negotiation suites. globs: src/**/*.{ts,js}, infra/**/*.tf, k8s/**/*.yaml, deploy/**/*.conf, gateway/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pqc-hybrid-mlkem-x25519-tls13-standard" --- # Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Accepting classical-only ECDH key exchanges (X25519, P-256) on public TLS 1.3 ingress points ## System Constraints You are a Principal Security Architect enforcing Post-Quantum Cryptography (PQC) standards across ingress termination proxies, edge layers, and microservice gateways. You must ensure all TLS configurations enforce TLS 1.3 as a hard baseline and place hybrid post-quantum key encapsulation mechanisms (specifically X25519MLKEM768, draft-ietf-tls-hybrid-design conforming to FIPS 203) as the premier group preference. Flag any configuration that degrades to classical-only key agreement without quantum hybridization, rejects fragmented ClientHello extensions, or tolerates TLS 1.2 on public endpoints. ## Strict Guidelines - Engineers MUST ALWAYS configure TLS 1.3 as the minimum protocol version (`minVersion: 'TLSv1.3'`) for public-facing edge terminators. - Engineers MUST configure hybrid post-quantum curves (preferring `X25519MLKEM768:x25519_kyber768:X25519:P-256`) as the highest-priority supported groups. - Services MUST enable TCP receive buffer scaling and MTU configurations capable of handling ClientHello and ServerHello flights enlarged by ML-KEM public key and ciphertext payloads (~1184 bytes). - Engineers MUST NOT permit fallback to TLS 1.2 or non-hybrid ephemeral key exchange curves (e.g., pure `secp256r1` or pure `x25519`) on exposed ingress proxies. - Monitoring systems MUST emit metrics tracking quantum-safe handshake negotiation rates (`tls_handshake_groups{group="X25519MLKEM768"}`) to identify legacy clients lacking PQC support. ## Bad vs Good Implementations ### Node.js TLS Termination with PQC Hybrid Curve Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configures TLS 1.2 as minimum, allows classical non-PQC ciphers, and omits the hybrid ML-KEM-768 key encapsulation curve group, leaving all traffic decryptable by future cryptanalytically relevant quantum computers (CRQC). ```typescript import https from 'node:https'; import fs from 'node:fs'; // CRITICAL FLAW: Uses default TLS curves which fall back to classical-only ECDH (X25519/P-256) // Vulnerable to Harvest Now, Decrypt Later (HNDL) adversary storage. const server = https.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.2', ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384:HIGH:!aNULL:!MD5' }); server.listen(443); ``` #### Production Standard (Correct) > **Standard**: Restricts transport strictly to TLS 1.3, mandates X25519MLKEM768 as the premier key exchange group, and injects runtime telemetry to trace any legacy degradations. ```typescript import https from 'node:https'; import fs from 'node:fs'; import tls from 'node:tls'; // Compliant: Requires TLS 1.3 and enforces ML-KEM-768 hybrid key encapsulation const server = https.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Standardized IETF group identifier for ML-KEM-768 + X25519 hybrid (FIPS 203) ecdhCurve: 'X25519MLKEM768:SecP256r1MLKEM768:X25519', ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256', honorCipherOrder: true }); server.on('secureConnection', (tlsSocket: tls.TLSSocket) => { const ephemeralKeyInfo = tlsSocket.getEphemeralKeyInfo(); if (ephemeralKeyInfo && 'name' in ephemeralKeyInfo) { const negotiatedGroup = ephemeralKeyInfo.name; if (!negotiatedGroup.includes('MLKEM')) { // Telemetry hook to alert on non-PQC ingress sessions console.warn(`[PQC-AUDIT] Non-quantum-resistant handshake negotiated: ${negotiatedGroup}`); } } }); server.listen(443); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail

Mandatory PQC Hybrid ML-KEM-768/X25519 TLS 1.3 Key Encapsulation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces post-quantum hybrid key encapsulation (X25519MLKEM768 / SecP256r1MLKEM768) on all public ingress termination points and API gateways to neutralize 'Harvest Now, Decrypt Later' (HNDL) adversary campaigns. Requires strict TLS 1.3 minimum versions, explicit quantum-safe elliptic curve and KEM preferences, and rejection of legacy cipher negotiation suites. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Accepting classical-only ECDH key exchanges (X25519, P-256) on public TLS 1.3 ingress points Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Accepting classical-only ECDH key exchanges (X25519, P-256) on public TLS 1.3 ingress points	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure TLS 1.3 as the minimum protocol version (`minVersion

Engineers MUST ALWAYS configure TLS 1.3 as the minimum protocol version (`minVersion: 'TLSv1.3'`) for public-facing edge terminators.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.