Cipher suite · 0x56,0x00
TLS_FALLBACK_SCSV
TLS_FALLBACK_SCSV (0x56,0x00) is a signaling cipher suite value (SCSV), not a real cipher suite: clients put it in the ClientHello to signal a capability, and it never gets negotiated.
Details
- IANA name
TLS_FALLBACK_SCSV- Hex code
0x56,0x00(22016)- OpenSSL
- Not available in OpenSSL 3.5
- GnuTLS
- Not implemented in GnuTLS
- Key exchange
- -
- Authentication
- -
- Encryption
- -
- MAC
- -
- TLS versions
- –
- IANA "Recommended"
- N — not evaluated or not recommended · DTLS-OK: Y
- References
- RFC 7507
What each component means
TLS_FALLBACK_SCSV (0x56,0x00) is a signal, not a cipher suite. A client that retries a failed handshake with a lower protocol version adds it to the cipher list; if the server supports a higher version than the one offered, it aborts with an inappropriate_fallback alert. RFC 7507 (2015) introduced it after POODLE abused such insecure fallbacks to push connections down to SSL 3.0. The RFC index now lists RFC 7507 as obsoleted by RFC 8996 (2021), which deprecated TLS 1.0 and 1.1; TLS 1.3 servers instead signal a downgrade in the last 8 bytes of ServerHello.random.
Why this rating
ssl.sh rating: Signal only. The reasons:
- Signaling value only; it carries no algorithms and is never negotiated.
History and standards status
TLS_FALLBACK_SCSV (0x56,0x00) is registered in the IANA TLS Cipher Suites registry with RFC 7507, “TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks” (April 2015, Standards Track) as its specification. RFC 7507 has since been obsoleted by RFC 8996 (2021).
How to test whether a server accepts it
Check that a server rejects insecure fallback: offer TLS 1.2 with the fallback signal to a server that supports TLS 1.3. A correct server aborts with an inappropriate fallback alert:
openssl s_client -connect example.com:443 -tls1_2 -fallback_scsv </dev/nullTo decode a name or hex code, use the cipher suite lookup; the SSL checker shows which protocol versions a live server accepts and the cipher suite it negotiates.
FAQ
Is TLS_FALLBACK_SCSV a real cipher suite?
No. It is a signaling cipher suite value: it carries no algorithms, is never selected by the server, and only tells the server something about the client. ssl.sh therefore does not rate it.
Do I need to configure TLS_FALLBACK_SCSV in Nginx or Apache?
No. Clients add it automatically and OpenSSL-based servers such as Nginx and Apache httpd recognise it without any directive; it doesn't appear in ssl_ciphers or SSLCipherSuite lists.
Does TLS_FALLBACK_SCSV matter with TLS 1.3?
Less than it used to. TLS 1.3 has downgrade protection built into ServerHello.random, and with TLS 1.0 and 1.1 deprecated there is little to fall back to; clients that no longer retry with older versions don't send it.