# What are the disadvantages of XOR key derivation?

Assume a 256-bit Key and a 256-bit Salt, with uniformly distributed entropy, both fully independent.

Assume Key is secret and Salt is public.

What theoretical advantages would deriving an AES-256-CTR encryption key using Key XOR Salt give to an attacker?

Assume that the product of Key XOR Salt will remain secret.

Assume that a KDF such as HKDF or a PRF such as HMAC cannot be used.

• I've deleted my question since it appears I've misunderstood you. Can you explain what exactly you want to accomplish? You don't need a salt if you already have a fully random secret key. Just XORing a key with a public value is pointless since you can XOR it with the public value again to obtain the secret key. – forest Nov 28 '18 at 10:09
• The question concerns the theoretical advantages that deriving an AES-256-CTR encryption key using Key XOR Salt would give to an attacker. It's theoretical, and again, it assumes that the product of the XOR remains secret, i.e. the obvious XOR round-trip is not available to an attacker. – Joran Greef Nov 28 '18 at 10:25
• Well it's pretty contrived, but there would certainly be no security issue as long as the two values are independent. I think you should change "salt" to something else though, since that value is not being used as a salt. I'm not sure what to call it. Maybe just "public value"? – forest Nov 28 '18 at 10:26
• Since they are independent, there's no way an attacker could intelligently influence the resulting key, which means naturally it cannot possibly give them a cryptographic advantage. – forest Nov 28 '18 at 10:32