Using multiple secret keys I have two secret keys. One is a secret key generated by OpenSSL (primary secret key). Second key is generated by performing one way hash operation to GPS co ordinates and time parameters (geo secret key). Now I want to combine this two keys to be used for an AES encryption. I have two options.


Encrypt twice by using two keys.
XOR the two keys derive a single key and use it for encryption.


The first option will be bit expensive since there will be two encryption operations. Although the second option will be less expensive I am not sure whether it is secure or not. Will the second option make the finale encryption key vulnerable? Will it severely affect the randomness of the finale key in a way that it is not usable?

More details about my requirement: I want to decrypt a message successfully only when the device is in a specific location. So I am deriving a second key based on the GPS data. But location and time cannot be kept secret. So I need to know whether will it reduce the randomness of my finale key due to the XOR operation done between Primary secret key and Geo secret key.
You elaborated that your goal is to make it possible to decrypt a message successfully "only when the device is in a specific location".

Great goal, but yeah, well, the particular scheme you describe in your question ain't gonna work. Someone who is not physically at the specific location, but who knows where the specific location is, can still infer the key and decrypt the ciphertext.  This is a fundamental flaw, and it's not something you can fix by sprinkling on a KDF or multiple keys.  It doesn't matter how many keys you have or how you combine them.  Sorry to break it to you, but your scheme is not secure, and it cannot be easily repaired.  You're asking the wrong question: your whole approach is flawed.

There's been academic work on this sort of problem (e.g., by Dorothy Denning), but it's a much harder problem than you seem to realize, and the resulting schemes look very different.  One has to find some source of unpredictable entropy that is visible to anyone who is at the specified location at the specified time, but that is not known or predictable to anyone else.  That's very challenging.

For the state of the art in this area, see the following papers:


Location-Based Authentication: Grounding Cyberspace for Better Security.  Dorothy Denning.  Computer Fraud &amp; Security, Feb. 1996. 
On location-restricted services. Eran Gabber and Avishai Wool. IEEE Networks, 13(6):44-52, November/December 1999. 


There may be more other work; I recommend that you do a literature search to check.