Suppose we are encrypting multiple files with AES in CBC mode and using 256 bit keys. Assume the IVs for the files are randomly generated with a secure method. Assume some key $K$ is generated with Argon2 from a secure passphrase with secure parameters.

Assume for each file we store the IV and 32 bytes of random data $R$. Let $K'=K\oplus{}R$.

Are there any benefits or drawbacks associated with using $K'$ instead of $K$ for encrption? Any protection against theoretical or practical key-reuse attacks or anything similar?

  • $\begingroup$ Last paragraph is not clear.. $\endgroup$
    – kelalaka
    Commented Jan 6, 2022 at 23:55
  • $\begingroup$ There is one main reason of PBKDFs ( Argon2 is one of them); make the password guess harder. AFAIK, you remove this main advantage. $\endgroup$
    – kelalaka
    Commented Jan 6, 2022 at 23:58
  • $\begingroup$ Maybe you should edit your question to write step by step? What is stored what is genereated, etc.? Why do you need to remove Argon2? instead of generating such methods? $\endgroup$
    – kelalaka
    Commented Jan 7, 2022 at 0:01
  • $\begingroup$ @kelalaka I think that may be more accurate to what I'm thinking. $\endgroup$
    – user
    Commented Jan 7, 2022 at 0:08
  • 1
    $\begingroup$ No problem that I can see though you can derive each key from Argon2 with salt parameter. You can also generate random key for each file and encrypt it with the derived key from password via Argon2 as descibed here. $\endgroup$
    – kelalaka
    Commented Jan 7, 2022 at 0:14

1 Answer 1


There are no theoretical or practical advantages when it comes to security, as the XOR with $R$ is easily reversed. Since the key is fully randomized and only dependent on the password, the security isn't degraded either. The XOR with a known value doesn't give any information to the attacker as both input and output are unknown - presuming your cipher / key usage is secure.

There is a practical advantage. It is possible to reuse an existing data encryption key while replacing the password. First you calculate a $K_{org}$ using a password hash and $P_{org}$, for which you require the initial password; $K_{org}$ or a derived key is used to encrypt the data. Then you calculate $K_{new}$ using $P_{new}$. What you store is with the ciphertext is $D=K_{new} \oplus K_{org}$. Now you've replaced your password, by calculating $K_{org}=K_{new} \oplus D$.

When you start you can also generate a random $K_{data}$ or $K_{master}$ which you can get to by always creating a $D$ for XOR key derivation. Basically you first create a randomized key, which you then force to another unpublished, randomized key using the XOR.

In other words, the advantage is in key management which helps with system level security rather than algorithm security.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.