diff --git a/p2p/net/conn/dial.go b/p2p/net/conn/dial.go
index 12f4168889c8aa262c3c4e8e2353e70152346f31..a2ce3c0c7acb87812a60a9e83d9acb2c5915bf0e 100644
--- a/p2p/net/conn/dial.go
+++ b/p2p/net/conn/dial.go
@@ -10,6 +10,7 @@ import (
 	addrutil "github.com/ipfs/go-libp2p/p2p/net/swarm/addr"
 	transport "github.com/ipfs/go-libp2p/p2p/net/transport"
 	peer "github.com/ipfs/go-libp2p/p2p/peer"
+	msmux "gx/ipfs/QmUeEcYJrzAEKdQXjzTxCgNZgc9sRuwharsvzzm5Gd2oGB/go-multistream"
 	manet "gx/ipfs/QmYVqhVfbK4BKvbW88Lhm26b3ud14sTBvcm1H7uWUx1Fkp/go-multiaddr-net"
 	context "gx/ipfs/QmZy2y8t9zQH2a1b8q2ZSLKp17ATuJoCNxxyMFG5qFExpt/go-net/context"
 	ma "gx/ipfs/QmcobAGsCjYt5DXoq9et9L8yR8er7o7Cu3DTvpaq12jYSz/go-multiaddr"
@@ -62,6 +63,12 @@ func (d *Dialer) Dial(ctx context.Context, raddr ma.Multiaddr, remote peer.ID) (
 			maconn = d.Wrapper(maconn)
 		}
 
+		err = msmux.SelectProtoOrFail(SecioTag, maconn)
+		if err != nil {
+			errOut = err
+			return
+		}
+
 		c, err := newSingleConn(ctx, d.LocalPeer, remote, maconn)
 		if err != nil {
 			maconn.Close()
diff --git a/p2p/net/conn/listen.go b/p2p/net/conn/listen.go
index 84ff12e6e30363e78e8e01e225161234087536c8..99d4826b5260f8af2be181968cdbb186c394e389 100644
--- a/p2p/net/conn/listen.go
+++ b/p2p/net/conn/listen.go
@@ -11,11 +11,14 @@ import (
 	peer "github.com/ipfs/go-libp2p/p2p/peer"
 	"gx/ipfs/QmQopLATEYMNg7dVqZRNDfeE2S1yKy8zrRh5xnYiuqeZBn/goprocess"
 	goprocessctx "gx/ipfs/QmQopLATEYMNg7dVqZRNDfeE2S1yKy8zrRh5xnYiuqeZBn/goprocess/context"
+	msmux "gx/ipfs/QmUeEcYJrzAEKdQXjzTxCgNZgc9sRuwharsvzzm5Gd2oGB/go-multistream"
 	tec "gx/ipfs/QmWHgLqrghM9zw77nF6gdvT9ExQ2RB9pLxkd8sDHZf1rWb/go-temp-err-catcher"
 	context "gx/ipfs/QmZy2y8t9zQH2a1b8q2ZSLKp17ATuJoCNxxyMFG5qFExpt/go-net/context"
 	ma "gx/ipfs/QmcobAGsCjYt5DXoq9et9L8yR8er7o7Cu3DTvpaq12jYSz/go-multiaddr"
 )
 
+const SecioTag = "/secio"
+
 // ConnWrapper is any function that wraps a raw multiaddr connection
 type ConnWrapper func(transport.Conn) transport.Conn
 
@@ -31,6 +34,8 @@ type listener struct {
 	wrapper ConnWrapper
 
 	proc goprocess.Process
+
+	mux *msmux.MultistreamMuxer
 }
 
 func (l *listener) teardown() error {
@@ -98,6 +103,11 @@ func (l *listener) Accept() (net.Conn, error) {
 			maconn = l.wrapper(maconn)
 		}
 
+		_, _, err = l.mux.Negotiate(maconn)
+		if err != nil {
+			return nil, err
+		}
+
 		c, err := newSingleConn(ctx, l.local, "", maconn)
 		if err != nil {
 			if catcher.IsTemporary(err) {
@@ -150,9 +160,12 @@ func WrapTransportListener(ctx context.Context, ml transport.Listener, local pee
 		Listener: ml,
 		local:    local,
 		privk:    sk,
+		mux:      msmux.NewMultistreamMuxer(),
 	}
 	l.proc = goprocessctx.WithContextAndTeardown(ctx, l.teardown)
 
+	l.mux.AddHandler(SecioTag, nil)
+
 	log.Debugf("Conn Listener on %s", l.Multiaddr())
 	log.Event(ctx, "swarmListen", l)
 	return l, nil