I'm using PasswordDeriveBytes in legacy code and can't use Rfc2898DeriveBytes just yet.

When I'm getting 24 and then 8 bytes, everything works perfectly. But when I'm getting first 8 and then 24, it crashes with an ArgumentException. Very strange, because with a 32/16 combination it works in both orders.

var deriver1 = new PasswordDeriveBytes("mykey-123456789", []);
var key1 = deriver1.GetBytes(24);
var iv1 = deriver1.GetBytes(8);

var deriver2 = new PasswordDeriveBytes("mykey-123456789", []);
var iv2 = deriver2.GetBytes(8);
var key2 = deriver2.GetBytes(24);  // BOOM: ArgumentException: Offset and length were out of bounds...

I would not expect ArgumentException... or is this a bug of this deprecated class? Does anyone have an explanation to this or to whether I am doing something wrong?