HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digest_size.