Check buffer lengths and HMAC return value in crypto.c

I've made sure that buffer lengths are consistently checked, and that the return value of HMAC is checked in crypto.c.