old_hmac_en/decode: return -1 on error