XOR isn't secure enough, but you're on the right track. Instead, use an actual block cipher.