5b5a030fa4
metadata is equal to -1. if we then wanted to attach provider (or change keys) and forget about '-p' flag it failed on assertion (quite ok, without assertion it could call PKCS#5v2 with 4294967295 iterations). Instead of failing on assertion, remind about '-p' flag. MFC after: 3 days