length of derived key could be asserted too