Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement

--- description: Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement - Enforces mandatory hybrid post-quantum key encapsulation (ML-KEM / Kyber combined with classical ECDH) across all edge ingress load balancers and reverse proxies. Prevents 'Harvest Now, Decrypt Later' (HNDL) adversaries from capturing classical TLS sessions today to decrypt retroactively via Shor's algorithm on cryptanalytically relevant quantum computers. globs: src/**/ingress/**/*.{ts,js,go,py}, src/**/tls/**/*.{ts,js,go,py}, infra/**/*.{ts,tf,json,yaml,yml}, k8s/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/pqc-ml-kem-tls13-hybrid-standard" --- # Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Deploying Classical-Only ECDH/RSA Key Exchange Vulnerable to Harvest-Now-Decrypt-Later Threat Models ## System Constraints You are a Principal Security Architect enforcing Post-Quantum Cryptography (PQC) standards conforming to NIST FIPS 203 (ML-KEM) and IETF hybrid key exchange specifications. Mandate TLS 1.3 with hybrid ML-KEM key exchange (X25519MLKEM768 or SecP256r1MLKEM768) at all edge ingress boundaries. Block legacy ciphers, classical-only ECDHE without hybrid fallback protection, and TLS versions below 1.3 for sensitive ingress. ## Strict Guidelines - Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) on all public and inter-region ingress listeners. - Engineers MUST ALWAYS prioritize hybrid ML-KEM groups (such as `X25519MLKEM768` or draft identifier `X25519Kyber768Draft00`) ahead of classical curves in the key exchange preference order. - Engineers MUST NOT allow TLS 1.0, 1.1, or 1.2 on edge listeners handling confidential or regulated payload transit. - Services MUST enable telemetry to measure PQ-negotiated handshakes versus classical fallback ratios and detect downgrade anomalies. - Infrastructure-as-Code definitions MUST NOT configure classical-only cipher suites (e.g., pure RSA key transport or non-hybrid ECDHE curves without ML-KEM support). ## Bad vs Good Implementations ### Edge Ingress Gateway TLS Server Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Configuring TLS 1.2 with classical-only curves (X25519 and prime256v1) makes all encrypted transit vulnerable to state-sponsored HNDL attacks. Captured ciphertext can be decrypted in the future using Shor's algorithm on a quantum computer. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // VULNERABLE: Classical-only curve list allows Harvest Now, Decrypt Later (HNDL) // Adversaries capturing traffic can store packets and decrypt them using quantum computing. export function configureEdgeTlsServer(): tls.Server { return tls.createServer({ key: fs.readFileSync('/etc/ssl/certs/ingress.key'), cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), minVersion: 'TLSv1.2', // Flaw: permits TLS 1.2 classical key exchanges ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384', ecdhCurve: 'X25519:prime256v1', // Flaw: purely classical Elliptic Curves }); } ``` #### Production Standard (Correct) > **Standard**: Enforces TLS 1.3 and specifies 'X25519MLKEM768' and 'X25519Kyber768Draft00' as prioritized key exchange groups. An adversary capturing this traffic cannot decrypt it without simultaneously breaking both classical discrete log and quantum-resistant lattice-based ML-KEM. ```typescript import * as tls from 'node:tls'; import * as fs from 'node:fs'; // SECURE: Enforces TLS 1.3 with hybrid ML-KEM (FIPS 203) key encapsulation. // Defends against HNDL by combining X25519 with post-quantum Kyber/ML-KEM. export function configureEdgeTlsServer(): tls.Server { return tls.createServer({ key: fs.readFileSync('/etc/ssl/certs/ingress.key'), cert: fs.readFileSync('/etc/ssl/certs/ingress.crt'), minVersion: 'TLSv1.3', // Invariant: Strict TLS 1.3 required for ML-KEM maxVersion: 'TLSv1.3', // Prioritize FIPS 203 hybrid ML-KEM groups; fallback to classical only for unupgraded clients ecdhCurve: 'X25519MLKEM768:X25519Kyber768Draft00:SecP256r1MLKEM768:X25519', honorCipherOrder: true, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement

Post-Quantum ML-KEM TLS 1.3 Hybrid Key Exchange Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces mandatory hybrid post-quantum key encapsulation (ML-KEM / Kyber combined with classical ECDH) across all edge ingress load balancers and reverse proxies. Prevents 'Harvest Now, Decrypt Later' (HNDL) adversaries from capturing classical TLS sessions today to decrypt retroactively via Shor's algorithm on cryptanalytically relevant quantum computers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Classical-Only ECDH/RSA Key Exchange Vulnerable to Harvest-Now-Decrypt-Later Threat Models Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Classical-Only ECDH/RSA Key Exchange Vulnerable to Harvest-Now-Decrypt-Later Threat Models	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion

Engineers MUST ALWAYS enforce TLS 1.3 as the strict minimum protocol version (`minVersion: 'TLSv1.3'`) on all public and inter-region ingress listeners.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.