TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Not a real cipher: a signaling value in the cipher list that announces secure renegotiation support. Only curl sends it in our data.
What it is
TLS_EMPTY_RENEGOTIATION_INFO_SCSV (code 0x00FF) is a signaling cipher suite value, or SCSV, defined in RFC 5746. It never gets negotiated as a cipher. Its presence in the cipher list tells the server that the client supports secure renegotiation, exactly like an empty renegotiation_info extension.
The SCSV exists for servers that break when they see unknown extensions. Putting the signal in the cipher list, where servers already ignore codes they do not know, let clients announce secure renegotiation without adding an extension. RFC 5746 requires clients to send either the SCSV or the extension in the initial handshake, and recommends against sending both.
A second signaling value, TLS_FALLBACK_SCSV from RFC 7507, works the same way to protect against version downgrade.
Its code, 0x00FF, is reserved for this signal by RFC 5746 and never stands for a real cipher.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 2 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
In our measurements only curl sends it: Debian curl as its 31st and last cipher value, macOS curl as the 34th. Both curl builds also leave out the renegotiation_info extension, while every other client sends the extension instead. Seeing this value at the end of the cipher list is therefore a quick way to spot curl.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the TLS details.
Run the TLS fingerprint test