Secure LSL (sLSL)

Encrypted Lab Streaming Layer for clinical and research environments

Secure LSL is a drop-in replacement for liblsl that adds transparent end-to-end encryption. Your existing LSL applications work unchanged; security is handled entirely within the library.

Important

Secure LSL is free for non-commercial academic and non-profit research use. Researchers and non-profit institutions may freely deploy it to secure their own Lab Streaming Layer setups and data (for example, encrypting EEG streams in a study), and may also reproduce, benchmark, verify, and modify it. Any other use, including commercial, industry, or for-profit use such as evaluation, modification, or deployment, requires a separate license from UC San Diego (Office of Innovation and Commercialization, innovation@ucsd.edu), which helps fund the continued maintenance and development of the platform. See LICENSE.

Features

• End-to-end encryption: ChaCha20-Poly1305 authenticated encryption
• Device authentication: Ed25519 digital signatures
• Replay attack prevention: Monotonic nonce tracking
• Zero code changes: Existing applications work unmodified
• Cross-platform: macOS, Linux, Windows (x86_64, ARM), ESP32 (WiFi)
• Full interoperability: Python, MATLAB, C++, C# all work together
• Embedded support: ESP32 microcontrollers with wire-compatible encryption (details)

Quick Start

# 1. Build the library (or download a release)
cd liblsl && mkdir build && cd build
cmake -DLSL_SECURITY=ON .. && cmake --build . --parallel

# 2. Generate encryption keys
./lsl-keygen

# 3. Verify setup
./lsl-config --check
# Output: Security: ENABLED

# 4. Run your existing LSL applications (no changes needed)

Verifying You're Using Secure LSL

Always verify you're using the secure library at runtime:

Python:

import pylsl
print(pylsl.library_info())  # Should contain "security"

C++:

#include <lsl_cpp.h>
if (!lsl::is_secure_build()) {
    std::cerr << "WARNING: Not using secure LSL!" << std::endl;
}
std::cout << "Version: " << lsl::full_version() << std::endl;
// Output: 1.16.1-secure.1.1.0

Command line:

./lslver
# Look for "security:X.X.X" in output

Documentation

• Quick Start Guide
• Installation
• Configuration Reference
• Migration from LSL
• Security Architecture
• API Reference

Or view the full documentation site:

pip install -r docs/requirements.txt
mkdocs serve
# Open http://localhost:8000

Compatibility

Binding	Status	Notes
Python (pylsl)	Works	Set PYLSL_LIB to point to liblsl-secure
MATLAB	Works	Update loadlibrary path
C++	Works	Link with -llsl-secure
C#	Works	Update DllImport attribute
LabRecorder	Works	Build with secure liblsl

All 150+ LSL applications work without modification.

Binary Naming

The secure library uses a distinct name to prevent confusion:

Platform	Regular LSL	Secure LSL
macOS	liblsl.dylib	liblsl-secure.dylib
Linux	liblsl.so	liblsl-secure.so
Windows	lsl.dll	lsl-secure.dll
ESP32	liblsl_esp32 (component)	Built-in (same component)

Version Information

Secure LSL uses a dual versioning scheme:

• Base version: Tracks upstream liblsl (e.g., 1.16.1)
• Security version: Tracks security layer (e.g., 1.1.0)
• Full version: Combined (e.g., 1.16.1-secure.1.1.0)

Query versions at runtime:

lsl_base_version();      // "1.16.1"
lsl_security_version();  // "1.0.0"
lsl_full_version();      // "1.16.1-secure.1.1.0"
lsl_is_secure_build();   // 1

// Passphrase-protected keys
lsl_security_is_locked();           // 1 if key needs passphrase
lsl_security_unlock("passphrase");  // Unlock the key
lsl_local_security_fingerprint();   // "BLAKE2b:79:8c:1d:7d..."

Repository Structure

secureLSL/
├── liblsl/              # Core library with security layer
├── docs/                # MkDocs documentation
├── benchmarks/          # Performance testing
├── tests/               # Integration tests
│   ├── python/          # Python tests
│   └── matlab/          # MATLAB tests
└── mkdocs.yml           # Documentation config

Building

Requirements

• CMake 3.12+
• C++17 compiler
• libsodium 1.0.18+

Build Commands

# macOS
brew install libsodium cmake
cd liblsl && mkdir build && cd build
cmake -DLSL_SECURITY=ON ..
cmake --build . --parallel

# Linux
apt install libsodium-dev cmake build-essential
cd liblsl && mkdir build && cd build
cmake -DLSL_SECURITY=ON ..
cmake --build . --parallel

# Windows (vcpkg)
vcpkg install libsodium
cd liblsl && mkdir build && cd build
cmake -DLSL_SECURITY=ON -DCMAKE_TOOLCHAIN_FILE=[vcpkg-root]/scripts/buildsystems/vcpkg.cmake ..
cmake --build . --config Release

Security Overview

Feature	Implementation	Purpose
Device Identity	Ed25519 signatures	Only authorized devices connect
Data Encryption	ChaCha20-Poly1305	Protect biosignal confidentiality
Tamper Detection	AEAD authentication	Detect any modification
Replay Prevention	Monotonic nonces	Block packet replay attacks
Key Exchange	X25519 + BLAKE2b	Secure session key derivation

For detailed security information, see Security Architecture.

Regulatory Compliance

Secure LSL helps meet requirements for:

• EU Cyber Resilience Act (2024/2847) - Secure by default, encryption, data integrity
• EU NIS2 Directive (2022/2555) - Cryptography policies, multi-factor authentication
• European Health Data Space (2025/327) - Encryption in transit, access control
• HIPAA Technical Safeguards (45 CFR 164.312)
• GDPR Article 32 security requirements
• FDA 21 CFR Part 11 electronic records

For NIS2 compliance requiring multi-factor authentication, run lsl-keygen and enter a passphrase when prompted (passphrase-protection is the default).

License

Copyright (C) 2025-2026 The Regents of the University of California. All Rights Reserved.

Author: Seyed Yahya Shirazi, SCCN, INC, UCSD

Secure LSL is proprietary software. See LICENSE for terms.

This software incorporates liblsl (MIT License) and libsodium (ISC License). Verbatim notices for all incorporated components are in THIRD-PARTY-NOTICES.md. The original open-source components are available from their respective repositories.