validate requested key length in kdf_pbkdf1_do_derive