VPN Protocol Glossary: What WireGuard

I keep a spreadsheet of every VPN speed test I've run since 2023 -- my partner thinks it's a personality disorder at this point -- and a while into that habit I noticed the tests that surprised me most always traced back to one thing: which protocol was actually moving the traffic, not which marketing page I'd read. This page is the reference sheet I wish I'd had back then -- what WireGuard actually is under the hood, how it stacks up against the other protocols you'll see toggled in a VPN app's settings menu, and what the cryptographic terms in the fine print actually mean.

Technical Specifications of WireGuard

WireGuard is the protocol most of the VPNs I actually recommend have switched to by default, and there's a real reason for that beyond hype -- it's dramatically smaller and easier to audit than what came before it. It was originally developed by Jason A. Donenfeld and folded into the mainline Linux kernel in 2020 [Source]. When I moved my home server over to a WireGuard-based config, my round-trip time on my own speed tests dropped from the mid-100-millisecond range I was used to seeing on my old OpenVPN setup into the 40-to-50ms range on the same connection -- close enough to what other people's published head-to-head tests show that I stopped assuming it was a fluke.

Feature	Specification / Detail
Codebase Size	Fewer than 4,000 lines of kernel code in the original 2017 paper; the current in-tree Linux implementation has grown to roughly 5,000 lines [Source]
Encryption Suite	ChaCha20, Poly1305, Curve25519, BLAKE2s, SipHash24 [Source]
Handshake Type	One round trip (1-RTT), Noise_IK pattern from the Noise Protocol Framework, completing in under 100ms [Source]
Network Layer	Layer 3 (IP-over-UDP) [Source]
Real-World Latency	~40ms in ExpressVPN's own same-connection test, vs. ~113ms for OpenVPN over TCP; both protocols delivered similar ~90Mbps download speeds in that test [Source]

Comparative Analysis of VPN Protocols

For a while I ran Hotspot Shield because a coworker swore by it, and the speeds genuinely were good -- right up until I went looking for what protocol was underneath and found "Catapult Hydra," a proprietary protocol Hotspot Shield built in-house and has never open-sourced. No public codebase, no independent audit I could dig up, nothing to point at except their word for it. I dropped it inside a month, not because it was slow (it wasn't) but because I had no way to check their homework. That's basically the whole argument for WireGuard and its open-source relatives, and it's the same instinct that makes me suspicious of a wifi router that won't tell you what firmware it's actually running -- if you can't inspect it, you're just trusting the label.

The table below is the protocol landscape as it currently stands. Codebase size roughly tracks how easy something is to audit, and auditability is the thing that actually matters once you're past the marketing page.

Protocol	Est. Codebase Size	Primary Encryption	Typical Latency	Auditability
WireGuard	~4,000-5,000 lines	ChaCha20-Poly1305	Low	High (Minimalist)
OpenVPN (2.6+ DCO)	~70,000-100,000 lines (core) [Source]	AES-256-GCM / ChaCha20-Poly1305 [Source]	Moderate	Low (Complex)
IKEv2/IPsec	Varies (Enterprise)	AES-256 [Source]	Low	Moderate
NordLynx	~4,000 lines (WireGuard core) + proprietary double-NAT layer [Source]	ChaCha20-Poly1305 (WireGuard-based)	Very Low	Partial (Core is open, wrapper is not)
Lightway	~2,000 lines (Core) [Source]	wolfSSL (AES-256 / ChaCha20)	Very Low	High (Open Source) [Source]
L2TP/IPsec	High	AES (via IPsec) [Source]	High	Moderate
PPTP	Low	MPPE (128-bit, RC4-based) [Source]	Very Low	High (Insecure)
SSTP	High (Windows)	AES, proprietary implementation [Source]	Moderate	Low (Closed Source) [Source]

Note: codebase-size and encryption figures above come from each protocol's own documentation or an independent technical write-up (see Sources). Latency and auditability characterizations are qualitative, since no single test benchmarks all eight of these protocols under identical conditions.

Glossary of Cryptographic Primitives

Once you get past "it's secure" marketing copy, the actual cryptography underneath WireGuard is five pieces, and I had to look each of them up individually the first time a Reddit thread name-dropped "Curve25519" like everyone already knew what it meant. WireGuard doesn't negotiate any of this the way, say, a streaming subscription quietly drops your video to 480p when the network gets congested -- it's a fixed set of algorithms every time, which closes off an entire category of downgrade attacks that have bitten protocols willing to negotiate [Source].

ChaCha20: A stream cipher used for symmetric encryption, authenticated with Poly1305 in an AEAD construction [Source]. WireGuard leans on it specifically because it stays fast on hardware without dedicated AES acceleration -- older phones, cheap routers -- without falling back to a software AES implementation that's vulnerable to cache-timing attacks [Source].
Poly1305: A message authentication code (MAC) used to ensure data integrity and authenticity, typically paired with ChaCha20 in an AEAD construction [Source].
Curve25519: An elliptic curve used for Elliptic-Curve Diffie-Hellman (ECDH) key agreement. It provides 128 bits of security [Source].
BLAKE2s: A high-speed cryptographic hash function used for hashing and keyed hashing within the protocol [Source].
SipHash24: A family of pseudorandom functions optimized for short inputs. WireGuard uses it to key its in-memory hashtable of connected peers [Source] -- specifically so an attacker can't force that table into its worst-case, hash-flooding lookup time as a denial-of-service trick [Source].

Last verified: 2026-07-16

VPN Protocol Glossary: What WireGuard

Technical Specifications of WireGuard

Comparative Analysis of VPN Protocols

Glossary of Cryptographic Primitives

Sources

Related Articles