make pkcs unpad constant with correct padding too
require >= 8 padding bytes, as per spec