Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard

--- description: Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard - Enforces post-quantum hybrid key encapsulation mechanisms (specifically X25519MLKEM768 / X25519Kyber768Draft00) and strict TLS 1.3 across all edge ingress listeners, API gateways, and microservice reverse proxies. Mitigates 'harvest now, decrypt later' (HNDL) attacks by rejecting pre-TLS 1.3 handshakes and preventing silent negotiation downgrade to classical-only key exchange groups. globs: src/**/tls*.ts, src/**/server.ts, src/**/gateway*.ts, src/**/ingress*.ts, infra/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pqc-ml-kem-hybrid-tls13-ingress-standard" --- # Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Permitting Classical-Only Key Exchange or TLS 1.2 on Edge Ingress Exposing Traffic to Retroactive Quantum Decryption ## System Constraints You are a Principal Security Architect enforcing the Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard. You MUST reject all edge ingress configurations, reverse proxies, and TLS server instantiations that allow classical-only key exchanges (such as pure P-256 or pure X25519 without quantum-resistant encapsulation) or TLS versions prior to TLSv1.3. Mandate hybrid ML-KEM-768 groups (e.g., X25519MLKEM768), strict cipher suites (TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256), and telemetry auditing for negotiated key exchange groups. ## Strict Guidelines - Services MUST enforce 'TLSv1.3' as both the minimum and maximum allowed TLS protocol version on all public and high-assurance ingress endpoints. - Engineers MUST configure curve and group preferences to prioritize hybrid Post-Quantum KEMs: 'X25519MLKEM768' (or OpenSSL 3.4+ / BoringSSL standardized ML-KEM-768 hybrid) followed by 'X25519Kyber768Draft00'. - Engineers MUST NOT allow TLS 1.2 or legacy non-PQC cipher suites (e.g., RSA key transport, static DH, CBC-mode ciphers). - Services MUST inspect and log the negotiated key exchange group via connection telemetry hooks to detect and alert on unauthorized classical key exchange fallbacks. - Components NEVER accept incoming connections with non-ephemeral key exchange or downgradeable group negotiations. ## Bad vs Good Implementations ### Node.js Ingress TLS Server Configuration with X25519MLKEM768 Hybrid Key Exchange #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring minVersion to TLSv1.2 and relying on default cipher suites allows classical-only key exchanges (such as standard NIST P-256 or non-hybrid X25519). Adversaries harvesting enterprise ingress ciphertext today can retroactively decrypt recorded traffic once cryptographically relevant quantum computers (CRQCs) become viable. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // VULNERABLE: Allows TLS 1.2 and classical-only ECDHE (P-256 / pure X25519). // Vulnerable to 'Harvest Now, Decrypt Later' (HNDL) quantum attacks. export const insecureServer = tls.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.2', ciphers: 'DEFAULT:!aNULL:!eNULL', }); insecureServer.listen(8443); ``` #### Production Standard (Correct) > **Standard**: Explicitly restricts the protocol strictly to TLS 1.3, binds the ecdhCurve preference list to hybrid post-quantum groups (X25519MLKEM768 and X25519Kyber768Draft00), and audits the negotiated ephemeral group on connection establishment, immediately terminating connections that fail the PQC invariant. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // HARDENED: Enforces TLS 1.3 exclusively with hybrid post-quantum key exchange groups const SECURE_PQC_GROUPS = [ 'X25519MLKEM768', 'X25519Kyber768Draft00' ].join(':'); export const pqcEnforcedServer = tls.createServer({ key: fs.readFileSync('/etc/ssl/certs/server.key'), cert: fs.readFileSync('/etc/ssl/certs/server.crt'), minVersion: 'TLSv1.3', maxVersion: 'TLSv1.3', ecdhCurve: SECURE_PQC_GROUPS, honorCipherOrder: true, ciphers: 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256', }); pqcEnforcedServer.on('secureConnection', (socket: tls.TLSSocket) => { const ephemeralInfo = socket.getEphemeralKeyInfo(); const groupName = ephemeralInfo && 'name' in ephemeralInfo ? ephemeralInfo.name : 'UNKNOWN'; // Verify negotiated key exchange group satisfies quantum safety invariant if (!groupName.includes('MLKEM') && !groupName.includes('Kyber')) { console.error(`[SECURITY ALERT] Non-PQC group negotiated: ${groupName}. Terminating.`); socket.destroy(); return; } console.info(`[PQC INGRESS] Established secure session with hybrid group: ${groupName}`); }); pqcEnforcedServer.listen(8443); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard

Post-Quantum Cryptography (PQC) ML-KEM Hybrid TLS 1.3 Ingress Standard defines an industrial-grade behavioral standard for security engineering. Enforces post-quantum hybrid key encapsulation mechanisms (specifically X25519MLKEM768 / X25519Kyber768Draft00) and strict TLS 1.3 across all edge ingress listeners, API gateways, and microservice reverse proxies. Mitigates 'harvest now, decrypt later' (HNDL) attacks by rejecting pre-TLS 1.3 handshakes and preventing silent negotiation downgrade to classical-only key exchange groups. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Classical-Only Key Exchange or TLS 1.2 on Edge Ingress Exposing Traffic to Retroactive Quantum Decryption Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Classical-Only Key Exchange or TLS 1.2 on Edge Ingress Exposing Traffic to Retroactive Quantum Decryption	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST enforce 'TLSv1.3' as both the minimum and maximum allowed TLS protocol version on all public and high-assurance ingress endpoints.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.