# A set of key pairs and one hash to secure them

I have a simple problem: I have a set of users' ECDSA key pairs, and say I want to encrypt them with a simple algorithm. I have access to one variable that uniquely identifies the user, so I hash it with a SHA-2 algorithm and have a string of bytes longer than each of the keys.

Is it safe to XOR a key pair, or XORing both of the keys together will make it easier to decode the original value?

What if I hash the entire key chain, does that make it much easier to get the data?

• Is your "variable that uniquely identifies the user" secret (i.e. only known to this user)? Only then it makes sense to use this to create an encryption key for this user. – Paŭlo Ebermann Sep 27 '11 at 14:34
• Yes, like a login and password together, so it is unique to the user and only the user can generate the whole variable. – ThePiachu Sep 27 '11 at 16:11

3. Using a one-time-pad twice means that the attacker can derive $x_1 \oplus x_2$ (i.e. the XOR of the two private keys). I don't know of any way to come from this to $x_1$ and $x_2$ (given also the public keys $g^{x_1}$ and $g^{x_2}$), but I would not wonder if someone would find a way to do this easier than trying all $x_1$.