One problem with pbkdf is the general lack of support. Prior to 5.5 I'm not aware of any commonly installed extension that provides pbkdf2. An alternative to length checks and pbkdf2 is to use sha256. That would mask the original key and ensure the correct key length.