xor with a random cookie?