kdf: add FIPS error state handling