# Is it safe to truncate/compress SHA256?

I am writing a small personal project where I would like to use AES to encrypt some documents. It seems to work pretty well, but I was wondering about one point of my code. The current structure is user inputs password -> key = sha256(password) -> compress(key) -> AES(document, key). Where compress XORs the key with itself. So for 128 bit AES the first half is XORed with the second to get a 128bit key. I do a similar operation for 192 bit AES. I have a few questions about this:

1. Is it safe? If not, could I just drop the extra bits?
2. Is there a better way to go from a password to a key? I think for the average password entropy is pretty low.
3. Could I use this method to generate an IV for some other block cipher mode?
• 1. Just drop them, though it should be safe to xor it is less common. 2. Yes, many better ways, look up "key derivation function" (kdf) such as scrypt and argon. 3. Yes, most KDFs allow you to generate a configurable length output. – Thomas M. DuBuisson Dec 1 '17 at 15:25
• I think the issue is the sha256 with a user-supplied input. Using a KDF with higher computational cost, such as Argon2 or at least the PBKDF2, can be better. – Inkeliz Dec 1 '17 at 15:48