Is it safe to truncate/compress SHA256? I am writing a small personal project where I would like to use AES to encrypt some documents. It seems to work pretty well, but I was wondering about one point of my code. The current structure is user inputs password -> key = sha256(password) -> compress(key) -> AES(document, key). Where compress XORs the key with itself. So for 128 bit AES the first half is XORed with the second to get a 128bit key. I do a similar operation for 192 bit AES. I have a few questions about this:


Is it safe? If not, could I just drop the extra bits?
Is there a better way to go from a password to a key? I think for the average password entropy is pretty low.
Could I use this method to generate an IV for some other block cipher mode?
Someone else should chime in here just to be sure, but as far as I know truncating SHA256 is "safe", in the sense that it would be as good as any other "safe" 128 bit hash. I don't think XORing helps in any way, dropping the bits is probably better. Your application of a truncated SHA256, however, is not safe.
Yes, there is absolutely a better way. Like you said, average password entropy is low. Your key therefore has low entropy. Brute forcing a low entropy key is easy, when the key derivation is a simple SHA256 round. You need to use a specialized password hashing function. SHA256 is designed to be fast, you need a function that is designed to resist such brute force attacks. Examples include Argon2, scrypt, and PBKDF2.
This depends on the design. An IV should not be predictable. What kind of password would you be using to generate an IV? Would you use it multiple times? Are there reasons why you can't use a random IV?