AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
securitycritical PriorityID: pqc-ml-kem-hybrid-tls-ingress-standard

Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange

Enforces post-quantum hybrid key encapsulation (X25519MLKEM768) on all perimeter ingress points and external API terminations. Neutralizes Harvest-Now-Decrypt-Later (HNDL) threats by guaranteeing TLS 1.3 key exchanges combine classical ECDH security with lattice-based ML-KEM-768 (FIPS 203) resistance.

Prohibited Anti-Pattern: Terminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption.

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange - Enforces post-quantum hybrid key encapsulation (X25519MLKEM768) on all perimeter ingress points and external API terminations. Neutralizes Harvest-Now-Decrypt-Later (HNDL) threats by guaranteeing TLS 1.3 key exchanges combine classical ECDH security with lattice-based ML-KEM-768 (FIPS 203) resistance.
globs: src/infra/**/*.{ts,js}, src/server/**/*.{ts,js}, src/gateway/**/*.{ts,js}, infra/**/*.yaml, k8s/**/*.yaml
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/pqc-ml-kem-hybrid-tls-ingress-standard"
---

# Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange

> **Severity**: CRITICAL | **Category**: security
> **Anti-Pattern Warning**: Terminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption.

## System Constraints
You are a Principal Security Architect enforcing the Post-Quantum ML-KEM Hybrid TLS 1.3 Ingress Standard. Reject any external-facing TLS listener, gateway definition, or secure context configuration that fails to prioritize or enforce dual classical-quantum hybrid key exchange (specifically X25519MLKEM768 / X25519Kyber768Draft00) over TLS 1.3. Prevent Harvest-Now-Decrypt-Later (HNDL) exposures by mandating TLSv1.3 minimum versions and explicit hybrid curve groups.

## Strict Guidelines
- Services MUST enforce 'TLSv1.3' as the minimum TLS protocol version across all public ingress contexts.
- Engineers MUST configure hybrid curve groups prioritizing 'X25519MLKEM768' (or 'X25519Kyber768Draft00' for legacy compatibility) as the primary key exchange group before classical fallback.
- Services MUST NOT permit TLS 1.2 or non-hybrid ephemeral curves (e.g., pure 'prime256v1' or standalone 'X25519') on perimeter endpoints carrying sensitive or long-lifecycle data.
- Certificates and cipher configurations MUST disable static RSA, legacy DHE, and CBC cipher suites on all external gateway definitions.
- Ingress controllers (e.g., Envoy, NGINX, Node.js edge listeners) MUST explicitly expose hybrid key exchange metrics to verify post-quantum client negotiation ratios.

## Bad vs Good Implementations
### Secure Context Ingress Configuration with ML-KEM Hybrid TLS 1.3

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: Configures TLS 1.2 minimum version and restricts ECDH groups to classical curves (prime256v1 and standalone X25519). Encrypted traffic intercepted today can be decrypted by future Cryptanalytically Relevant Quantum Computers (CRQCs).
```typescript
import tls from 'node:tls';

// CRITICAL FLAW: Classical-only curve enables Harvest-Now-Decrypt-Later adversaries.
// Permitting TLS 1.2 allows quantum-vulnerable key exchanges.
export function createPublicTlsContext(cert: string, key: string): tls.SecureContext {
  return tls.createSecureContext({
    cert,
    key,
    minVersion: 'TLSv1.2',
    ecdhCurve: 'prime256v1:X25519',
    ciphers: 'HIGH:!aNULL:!MD5'
  });
}
```

#### Production Standard (Correct)
> **Standard**: Restricts protocol to TLSv1.3 and specifies X25519MLKEM768 as the highest priority key exchange curve, neutralizing HNDL threats while preserving interoperability with non-PQC clients through dual-encapsulation fallbacks.
```typescript
import tls from 'node:tls';

// SECURE: Enforces TLS 1.3 and ML-KEM-768 hybrid key exchange (X25519MLKEM768)
export function createPublicTlsContext(cert: string, key: string): tls.SecureContext {
  return tls.createSecureContext({
    cert,
    key,
    minVersion: 'TLSv1.3',
    // X25519MLKEM768 prioritizes FIPS 203 hybrid exchange with classical fallback
    ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00:X25519',
    honorCipherOrder: true
  });
}
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

TLS Protocol & Ingress Verifier
Validates live ingress and load balancer TLS 1.3 configurations and post-quantum curve negotiation support.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

PQC Handshake Inspector
CLI utility to simulate client hellos testing X25519MLKEM768 and SecP256r1MLKEM768 hybrid handshakes.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange

Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange defines an industrial-grade behavioral standard for security engineering. Enforces post-quantum hybrid key encapsulation (X25519MLKEM768) on all perimeter ingress points and external API terminations. Neutralizes Harvest-Now-Decrypt-Later (HNDL) threats by guaranteeing TLS 1.3 key exchanges combine classical ECDH security with lattice-based ML-KEM-768 (FIPS 203) resistance. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Terminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption. Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftTerminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption.Critical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Services MUST enforce 'TLSv1.3' as the minimum TLS protocol version across all public ingress contexts.

Services MUST enforce 'TLSv1.3' as the minimum TLS protocol version across all public ingress contexts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST configure hybrid curve groups prioritizing 'X25519MLKEM768' (or 'X25519Kyber768Draft00' for legacy compatibility) as the primary key exchange group before classical fallback.

Engineers MUST configure hybrid curve groups prioritizing 'X25519MLKEM768' (or 'X25519Kyber768Draft00' for legacy compatibility) as the primary key exchange group before classical fallback.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Services MUST NOT permit TLS 1.2 or non-hybrid ephemeral curves (e.g., pure 'prime256v1' or standalone 'X25519') on perimeter endpoints carrying sensitive or long-lifecycle data.

Services MUST NOT permit TLS 1.2 or non-hybrid ephemeral curves (e.g., pure 'prime256v1' or standalone 'X25519') on perimeter endpoints carrying sensitive or long-lifecycle data.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Certificates and cipher configurations MUST disable static RSA, legacy DHE, and CBC cipher suites on all external gateway definitions.

Certificates and cipher configurations MUST disable static RSA, legacy DHE, and CBC cipher suites on all external gateway definitions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Ingress controllers (e.g., Envoy, NGINX, Node.js edge listeners) MUST explicitly expose hybrid key exchange metrics to verify post-quantum client negotiation ratios.

Ingress controllers (e.g., Envoy, NGINX, Node.js edge listeners) MUST explicitly expose hybrid key exchange metrics to verify post-quantum client negotiation ratios.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Mandatory ML-KEM-768 Hybrid TLS 1.3 Ingress Key Exchange critical for AI coding assistants?

Enforces post-quantum hybrid key encapsulation (X25519MLKEM768) on all perimeter ingress points and external API terminations. Neutralizes Harvest-Now-Decrypt-Later (HNDL) threats by guaranteeing TLS 1.3 key exchanges combine classical ECDH security with lattice-based ML-KEM-768 (FIPS 203) resistance. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Terminating public TLS with classical-only curves (X25519 or secp256r1) vulnerable to retrospective quantum decryption.) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related SECURITY Rules

View all rules →
security
105

OpenFGA Graph Invariants: Cyclic Relation Prevention & Contextual Tuple Hardening

Enforces strict directed acyclic graph (DAG) topology validation during relationship mutation writes and mandates strict server-side schema verification for ephemeral contextual tuples in OpenFGA evaluations. Prohibits persistent storage of ephemeral request attributes and guards against recursive relation loops causing graph expansion denial-of-service.

security
81

WebAuthn Conditional UI Mediation, Nonce Atomicity, and Assertion Cryptographic Verification

Enforces zero-trust cryptographic validation for FIDO2/WebAuthn Passkey authentication with Conditional UI autofill. Requires atomic single-use challenge consumption to eliminate replay attacks, strict RP ID hash and origin binding, authenticatorData flag verification (User Presence and User Verification), and monotonic signature counter enforcement to detect authenticator cloning.

security
111

Enforce Sigstore Keyless OIDC Attestation and Admission Controller Verification

Enforces immutable supply-chain security using Sigstore Cosign keyless signing via ephemeral OIDC tokens issued by Fulcio and verified against the Rekor transparency log. Container workloads must be signed and attested at build time by digest, and admission controllers (such as Kyverno or Sigstore Policy Controller) must strictly validate the OIDC issuer and subject identity before allowing image execution.

1 Rule in Stack

Mandatory