This whole thread is like a textbook example of why people like me (breakers) have itchy trigger fingers when it comes to people building cryptography features.

I'm glad if this has been a good learning experience for you (may I suggest another?†), but real secure systems aren't, to steal a phrase from Richard Stallman, "debugged into existence": they start from a foundation of a secure, well-considered design and are verified piece by piece as the system is assembled.

† http://www.matasano.com/articles/crypto-challenges