This question elaborates that OpenVPN uses two channels to transfer data.

It first sets up a TLS connection (called control channel) and uses that to transfer a symmetric key and some other control data. It then sets up another channel (data channel) and starts transferring the actual data encrypted using the key.

Why the second channel? Why not simple transferring all data using TLS?

3 Answers 3


There's some truth in the other answers, but the primary reason is different: because OpenVPN was designed as IP-over-UDP, while TLS runs over TCP. Futhermore, the initial versions of OpenVPN did not have key exchange at all, but already had their own (better designed than TLS) data channel protocol. So when TLS was added, it made sense to stick to that for the data channel.

(Nowadays there's DTLS that runs over UDP, but that didn't exist when the OpenVPN protocol was created.)

  • That's what I thought that it is a legacy thing. Thank you
    – tsusanka
    Nov 30, 2017 at 10:44
  • 2
    Not just legacy, also because the openvpn data channel is optimized for openvpn's needs. Nov 30, 2017 at 10:51
  • 2
    This is a much better answer than mine. I did not know OpenVPN came before DTLS!
    – forest
    Dec 1, 2017 at 5:05

OpenVPN is not designed only for one type of key exchange. There are multiple types of key exchange supported by OpenVPN. Rather than creating a new protocol for every single type, the developers use a single protocol, the data channel, and allows different features to provide the key using their own protocols, such as TLS. Additionally, this allows features such as --tls-auth to be used to provide security features which plain TLS does not provide (in this case, authentication before TLS even comes into play, as a second line of defense).

The OpenVPN documentation explains the two default types of key exchange, static keys and TLS.

  • Hm, I understand. Is it actually common to use other protocols to provide the key? It seems as a little bit as a theoretical option
    – tsusanka
    Nov 28, 2017 at 12:00

It is all about SPEED!! The two channels have to do with key symmetry. In other words, whether the encryption protocol uses the same key for encryption and decryption (symmetric) OR different keys for encryption / decryption (asymmetric).

Generally speaking... Symmetric keys are really fast. Asymmetric keys are very slow. So how do get the same key to both sides for speed without a hacker grabbing the key? You use asymmetric keys and techniques (control channel) just long enough to get the symmetric key to both sides securely, and then open a data channel that will use the fast symmetric key.

You will find the data channel is always using a symmetric key. The process is more complicated, but that is the general idea.

  • Why the downvote? Also, wasn't OpenVPN all about security in comparison to Wireguard which is all about being lean and fast? Oct 6, 2022 at 18:19
  • 2
    TLS uses symmetric keys as well. So the answer's just plain incorrect.
    – vidarlo
    Oct 6, 2022 at 18:43
  • 1
    @SirMuffington the reason for having a control channel has absolutely nothing to do with speed. In any way. The second channel isn't even strictly required. I think the poster tried to explain the difference between symmetric and asymmetric encryption and made many leaps in logic when they tried to post an explanation for the control channel. But this doesn't even answer the question for why the control channel is required and why the data channel isn't used for everything.
    – schroeder
    Oct 6, 2022 at 19:14
  • Ah ok, makes sense now. With "Why the downvote" I meant why downvote without commenting. Oct 7, 2022 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .