improved attack (but still need to fix strxor and hexxor so they pad with zeros for unequal strings)