Assume I have a source that generates symmetric keys. This source could be a very solid HSM device, somewhat reliable PRNG, a compromised key generator or a hardcoded value which returns the same byte sequence every time.
Thus, I am not sure if the key I receive is really trustworthy. So, what I plan to do is to generate another random key locally, and XOR these two.
My PRNG generator would be more reliable than a compromised system, but less reliable than a proper HSM device.
My question is, does "XOR'ing these keys" lower my security in any way? What if I have to add a couple more keys into the mix? Will XORing these remove the less than ideal security level of some keys (but not all) in the mix?
UPDATE Let me put it in another way: Assume I have a number of key generator sources and ideally all should generate secure keys. But there is always the possibility of some of these key generators are less than ideal security-wise.
This not-ideal condition could be because of a bug in the key generator (like the Debian case), it could be a backdoor placed by a 3rd party (NSA, Chinese Gov., North Korea, Your neighbour script kiddy,...), or a very different problem affecting the security level.
As long as I have at least one of the Key Generators generating "acceptably secure" keys, will XORing all of them reduce the level of security in any way?
My gut feeling is, since all keys are practically random sequence of bytes, XORing anything with a random sequence does not change the randomness. But I don't have anything to back this up.
So if you have anything supporting my gut feeling or against it, that would be great. If you don't, I also would like to hear your thoughts.