Can I secure my key by XORing it with a hashed password?

Question

I'd like to build a simple password-protected symmetric key system. The key-creation process in my system operates as follows:

1. The system creates a 256-bit key purely at random.
2. The user chooses a password, which is hashed using SHA-256.
3. The system stores the value key XOR SHA(password), which we call the "pseudo-key".

The pseudo-key is stored permanently by the system or user, whereas the actual key and password hash are never stored. When the user wants to produce his key for encryption or decryption, he can recreate the actual key from pseudokey XOR SHA(password). The password hash and actual key are always destroyed immediately after use.

• Aside from an adversary obtaining the pseudo-key and brute-forcing the password, are there any obvious theoretical problems with this system?
• Is it notably inferior to other extant password-based key systems?
• Is the system I'm describing (or any system that password-protects a symmetric key) already present in some cryptographic library?

Answer 1

You are using a Vernam-encryption (simple XOR), as for the one-time pad.

The general principle for Vernam is that it is perfectly secure as long as you never reuse the same key for more than one message, and gets utterly broken as soon as it is reused even once (this is the "two-time pad"). The key here is the hashed password, the message the key.

If one of your encrypted keys is leaked, all others encrypted with the same password are immediately broken, too (since you can get the password hash, which is the actual key). You normally don't want this property in an encryption system, even if it is only used for data which is of random nature and of only temporary use.

Instead, do one of the following things:

• Use a real encryption (like a block cipher) with the hashed password as key and the stored key as input.
• Use some (random) salt in the hash function, so that each use of the password gives another hash. Store the salt with the XOR-ed key.
• Use a key derivation function to derive the actual key from salt and password. Do only store the salt, not the key in any form.

The OpenPGP message format uses some of these, I think.