Secure LSL (sLSL)

Encrypted Lab Streaming Layer for clinical and research environments

Secure LSL is a drop-in replacement for liblsl that adds transparent end-to-end encryption. Your existing LSL applications work unchanged; security is handled entirely within the library.

Features

• End-to-end encryption: ChaCha20-Poly1305 authenticated encryption
• Device authentication: Ed25519 digital signatures
• Replay attack prevention: Monotonic nonce tracking
• Zero code changes: Existing applications work unmodified
• Cross-platform: macOS, Linux, Windows (x86_64, ARM), ESP32 (WiFi)
• Full interoperability: Python, MATLAB, C++, C# all work together
• Embedded support: ESP32 microcontrollers with wire-compatible encryption (details)

Quick Start

# 1. Build the library (or download a release)cd liblsl && mkdir build &&cd build
cmake -DLSL_SECURITY=ON .. && cmake --build . --parallel
# 2. Generate encryption keys
./lsl-keygen
# 3. Verify setup
./lsl-config --check
# Output: Security: ENABLED# 4. Run your existing LSL applications (no changes needed)

Verifying You're Using Secure LSL

Always verify you're using the secure library at runtime:

Python:

importpylslprint(pylsl.library_info()) # Should contain "security"

C++:

#include<lsl_cpp.h>if (!lsl::is_secure_build()) {
std::cerr << "WARNING: Not using secure LSL!" << std::endl;
}
std::cout << "Version: " << lsl::full_version() << std::endl;
// Output: 1.16.1-secure.1.0.0-alpha

Command line:

./lslver
# Look for "security:X.X.X" in output

Documentation

• Quick Start Guide
• Installation
• Configuration Reference
• Migration from LSL
• Security Architecture
• API Reference

Or view the full documentation site:

pip install -r docs/requirements.txt
mkdocs serve
# Open http://localhost:8000

Compatibility

Binding	Status	Notes
Python (pylsl)	Works	Set PYLSL_LIB to point to liblsl-secure
MATLAB	Works	Update loadlibrary path
C++	Works	Link with -llsl-secure
C#	Works	Update DllImport attribute
LabRecorder	Works	Build with secure liblsl

All 150+ LSL applications work without modification.

Binary Naming

The secure library uses a distinct name to prevent confusion:

Platform	Regular LSL	Secure LSL
macOS	liblsl.dylib	liblsl-secure.dylib
Linux	liblsl.so	liblsl-secure.so
Windows	lsl.dll	lsl-secure.dll
ESP32	liblsl_esp32 (component)	Built-in (same component)

Version Information

Secure LSL uses a dual versioning scheme:

• Base version: Tracks upstream liblsl (e.g., 1.16.1)
• Security version: Tracks security layer (e.g., 1.0.0-alpha)
• Full version: Combined (e.g., 1.16.1-secure.1.0.0-alpha)

Query versions at runtime:

lsl_base_version(); // "1.16.1"lsl_security_version(); // "1.0.0"lsl_full_version(); // "1.16.1-secure.1.0.0-alpha"lsl_is_secure_build(); // 1// Passphrase-protected keyslsl_security_is_locked(); // 1 if key needs passphraselsl_security_unlock("passphrase"); // Unlock the keylsl_local_security_fingerprint(); // "BLAKE2b:79:8c:1d:7d..."

Repository Structure

secureLSL/
├── liblsl/ # Core library with security layer
├── docs/ # MkDocs documentation
├── benchmarks/ # Performance testing
├── tests/ # Integration tests
│ ├── python/ # Python tests
│ └── matlab/ # MATLAB tests
└── mkdocs.yml # Documentation config

Building

Requirements

• CMake 3.12+
• C++17 compiler
• libsodium 1.0.18+

Build Commands

# macOS
brew install libsodium cmake
cd liblsl && mkdir build &&cd build
cmake -DLSL_SECURITY=ON ..
cmake --build . --parallel
# Linux
apt install libsodium-dev cmake build-essential
cd liblsl && mkdir build &&cd build
cmake -DLSL_SECURITY=ON ..
cmake --build . --parallel
# Windows (vcpkg)
vcpkg install libsodium
cd liblsl && mkdir build &&cd build
cmake -DLSL_SECURITY=ON -DCMAKE_TOOLCHAIN_FILE=[vcpkg-root]/scripts/buildsystems/vcpkg.cmake ..
cmake --build . --config Release

Security Overview

Feature	Implementation	Purpose
Device Identity	Ed25519 signatures	Only authorized devices connect
Data Encryption	ChaCha20-Poly1305	Protect biosignal confidentiality
Tamper Detection	AEAD authentication	Detect any modification
Replay Prevention	Monotonic nonces	Block packet replay attacks
Key Exchange	X25519 + HKDF	Secure session key derivation

For detailed security information, see Security Architecture.

Regulatory Compliance

Secure LSL helps meet requirements for:

• EU Cyber Resilience Act (2024/2847) - Secure by default, encryption, data integrity
• EU NIS2 Directive (2022/2555) - Cryptography policies, multi-factor authentication
• European Health Data Space (2025/327) - Encryption in transit, access control
• HIPAA Technical Safeguards (45 CFR 164.312)
• GDPR Article 32 security requirements
• FDA 21 CFR Part 11 electronic records

For NIS2 compliance requiring multi-factor authentication, run lsl-keygen and enter a passphrase when prompted (passphrase-protection is the default).

License

Copyright (C) 2025-2026 The Regents of the University of California. All Rights Reserved.

Author: Seyed Yahya Shirazi, SCCN, INC, UCSD

Secure LSL is proprietary software. See LICENSE for terms.

This software incorporates liblsl (MIT License) and libsodium (ISC License). The original open-source components are available from their respective repositories.