Cross-transport PQC: (D)TLS hybrid/pure ML‑KEM; IKEv2/IPsec hybrids + re‑key

[vparla]

Summary

• Clarify PQC guidance across transports.
• (D)TLS: add NamedGroups for hybrid and pure ML‑KEM.
• IKEv2/IPsec: hybrids via RFC 9242/9370; include re‑key guidance; telemetry wording.

Changes

• Updated source rule:
  • c:\Work\rules\sources\core\codeguard-1-post-quantum-cryptography.md
• Regenerated skill:
  • c:\Work\rules\skills\software-security\rules\codeguard-1-post-quantum-cryptography.md

(D)TLS specifics

• Hybrids per I-D.ietf-tls-ecdhe-mlkem:
  • X25519MLKEM768
  • SecP256r1MLKEM768
  • SecP384r1MLKEM1024 (high‑assurance)
• Pure PQC per I-D.ietf-tls-mlkem-key-agreement:
  • ML‑KEM‑768 baseline; ML‑KEM‑1024 where required; avoid ML‑KEM‑512 except in constrained environments
• Use vendor‑documented identifiers; avoid legacy “Hybrid‑Kyber”.

IKEv2/IPsec specifics

• Enforce IKEv2; ESP with AEAD; PFS via ECDHE; disable legacy suites.
• Hybrids with ML‑KEM‑768 + ECDHE (X25519 or P‑256) using RFC 9242/9370 multi‑KE; apply to initial and re‑key (CREATE_CHILD_SA).
• Re‑key: time/byte lifetimes for IKE_SA and CHILD_SAs; ensure hybrids persist across re‑keys.

Validation

• Validator: 109/109 passed
• Converter: skills regenerated
• Frontmatter: description + alwaysApply: true