PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention

--- description: PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention - Enforces quantum-safe hybrid key exchange (X25519MLKEM768) across TLS 1.3 ingresses while strictly mitigating MTU fragmentation and eliminating insecure client-side fallback loops. Prevents Harvest-Now-Decrypt-Later (HNDL) vector exposure and middlebox TCP blackholing by enforcing deterministic group preference and cryptographic downgrade protection. globs: src/infrastructure/**/*.{ts,js}, src/network/**/*.{ts,js}, src/gateway/**/*.{ts,js}, src/security/**/*.{ts,js}, src/proxy/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pqc-hybrid-tls-mlkem-fallback-hardening" --- # PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Unbounded TLS ClientHello Payload Bloat and Insecure Classical Fallback Loops Under PQC Negotiation ## System Constraints You are a Principal Security Architect enforcing Post-Quantum Cryptography (PQC) hybrid TLS 1.3 standards. Your mandate is to enforce ML-KEM-768/X25519 hybrid key exchange (X25519MLKEM768 / SecP256r1MLKEM768) to mitigate Harvest-Now-Decrypt-Later (HNDL) adversaries, while strictly preventing IP packet fragmentation across standard 1500-byte Ethernet MTUs and forbidding programmatic classical-only fallback loops. ## Strict Guidelines - Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`); TLS 1.2 and below MUST be rejected. - Engineers MUST prioritize hybrid post-quantum key agreement groups (e.g., `X25519MLKEM768:X25519`) in `ecdhCurve` or group preference lists. - Engineers MUST NOT implement programmatic try-catch fallback routines that catch TLS handshake failures and retry with classical-only ciphers or groups. - Ingress proxies and gateway configurations MUST optimize ClientHello/ServerHello extension budgets to keep the initial TLS handshake frame within single-packet TCP Maximum Segment Size (MSS typically 1460 bytes) to prevent middlebox blackholing. - Services MUST rely exclusively on in-band TLS 1.3 Supported Groups negotiation for backward compatibility rather than out-of-band downgrade retries. - Engineers MUST enforce strict certificate compression (RFC 8879) using Brotli or Zstandard when quantum-safe hybrid key exchanges or large certificate chains are configured. ## Bad vs Good Implementations ### Edge Gateway Ingress TLS Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This configuration permits legacy TLS versions (1.0/1.2), loads an excessive number of key share groups causing packet fragmentation beyond standard 1500-byte MTUs, and implements an application-level fallback loop that an active attacker can trigger via simple TCP RST injection to force classical encryption. ```typescript import * as https from 'node:https'; import * as tls from 'node:tls'; // ANTI-PATTERN: Allows legacy TLS, manual downgrade loop on failure, // and unconstrained key exchange groups that inflate packets. export async function fetchWithInsecureFallback(targetUrl: string): Promise<void> { try { // Attempt PQC connection await makeRequest(targetUrl, { minVersion: 'TLSv1.2', ecdhCurve: 'X25519MLKEM768:secp384r1:secp256r1:prime256v1:X25519', }); } catch (err: unknown) { // CRITICAL: Silent fallback to classical-only allows downgrade attacks (HNDL target) console.warn('PQC Handshake failed. Falling back to classical RSA/ECDH...', err); await makeRequest(targetUrl, { minVersion: 'TLSv1.0', ciphers: 'DEFAULT@SECLEVEL=1', ecdhCurve: 'secp256r1', }); } } function makeRequest(url: string, opts: tls.SecureContextOptions): Promise<void> { return new Promise((resolve, reject) => { const req = https.get(url, opts, (res) => { res.resume(); resolve(); }); req.on('error', reject); }); } ``` #### Production Standard (Correct) > **Standard**: Enforces TLS 1.3 exclusively, restricts ECDH curves strictly to 'X25519MLKEM768:X25519' to keep the initial ClientHello under standard MTU thresholds, and eliminates programmatic fallback vectors, maintaining absolute resistance against HNDL harvest and active downgrade attacks. ```typescript import * as https from 'node:https'; import * as tls from 'node:tls'; // SECURE: Enforces strict TLS 1.3, hybrid ML-KEM-768 with X25519, // eliminates downgrade loops, and bounds handshake size within MTU limits. export const SECURE_TLS_PQC_CONFIG: Readonly<tls.SecureContextOptions> = Object.freeze({ minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', // Prioritize X25519MLKEM768 (0x11ec) hybrid, with single classical X25519 for standards-based fallback ecdhCurve: 'X25519MLKEM768:X25519', ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256', honorCipherOrder: true, }); export async function executeHardenedPqcRequest(targetUrl: string): Promise<Buffer> { return new Promise<Buffer>((resolve, reject) => { const req = https.get(targetUrl, { ...SECURE_TLS_PQC_CONFIG, timeout: 5000, }, (res) => { if (res.statusCode && res.statusCode >= 400) { reject(new Error(`Upstream rejected request: HTTP ${res.statusCode}`)); return; } const chunks: Buffer[] = []; res.on('data', (chunk: Buffer) => chunks.push(chunk)); res.on('end', () => resolve(Buffer.concat(chunks))); }); req.on('error', (err: Error) => { // Invariant: Fail-closed. Never downgrade cryptographic strength on network anomaly. reject(new Error(`TLS Handshake Failed: Integrity preserved without fallback. Cause: ${err.message}`)); }); req.on('timeout', () => { req.destroy(new Error('TLS negotiation timeout. Verification failed.')); }); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention

PQC Hybrid TLS 1.3 ML-KEM Key Exchange Hardening & MTU Fragmentation Prevention defines an industrial-grade behavioral standard for security engineering. Enforces quantum-safe hybrid key exchange (X25519MLKEM768) across TLS 1.3 ingresses while strictly mitigating MTU fragmentation and eliminating insecure client-side fallback loops. Prevents Harvest-Now-Decrypt-Later (HNDL) vector exposure and middlebox TCP blackholing by enforcing deterministic group preference and cryptographic downgrade protection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded TLS ClientHello Payload Bloat and Insecure Classical Fallback Loops Under PQC Negotiation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded TLS ClientHello Payload Bloat and Insecure Classical Fallback Loops Under PQC Negotiation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Services MUST enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`); TLS 1.2 and below MUST be rejected.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.