static _deriveKey(cryptoScheme, dataKey, log, cb) {
        if (cryptoScheme <= 1) {
            /* we are not storing hashed human password.
             * It's a random key, so 1 iteration and
             * a fixed salt is enough for our usecase.
             * don't change the salt, the iteration number
             * or the digest algorithm (sha1 here) without
             * bumping the cryptoScheme number saved in the object
             * metadata along with the dataKey.
             */
            const salt = Buffer.from('ItsTasty', 'utf8');
            const iterations = 1;
            return crypto.pbkdf2(
                dataKey, salt, iterations,
                this._keySize(), 'sha1', (err, derivedKey) => {
                    if (err) {
                        log.error('pbkdf2 function failed on key derivation',
                                  { error: err });
                        cb(errors.InternalError);
                        return;
                    }
                    crypto.pbkdf2(
                        derivedKey, salt, iterations,
                        this._IVSize(), 'sha1', (err, derivedIV) => {
                            if (err) {
                                log.error(
                                    'pbkdf2 function failed on IV derivation',
                                    { error: err });
                                return cb(errors.InternalError);
                            }
                            // derivedKey is the actual data encryption or
                            // decryption key used in the AES ctr cipher
                            return cb(null, derivedKey, derivedIV);
                        });
                });
        }
        log.error('Unknown cryptographic scheme', { cryptoScheme });
        return cb(errors.InternalError);
    }
Derive key to use in cipher
@param {number} cryptoScheme - cryptoScheme being used
@param {buffer} dataKey - the unencrypted key (either from the
appliance on a get or originally generated by kms in the case of a put)
@param {object} log - logger object
@param {function} cb - cb from createDecipher
@returns {undefined}
@callback called with (err, derivedKey, derivedIV)