basic secure compare with XOR