correctly throw error from failed call to pbkdf2