dumb XOR encoding/decoding