I am using a KDF to derive a key,
p' from a password
p. I would like to know if the password is correct before using the derived key.
Bruce Schneier's PasswordSafe format V3 has
H(P') is SHA-256(P'), and is used to verify that the user has the correct passphrase.
I understand that bcrypt uses the derived key with Blowfish to encrypt "OrpheanBeholderScryDoubt" 64 times to create a password hash. (edit: I am not concerned specifically about Blowfish, but about any block cipher used in this manner. Bcrypt is just an example.)
Is there any difference in the security of these two approaches to verifying a password?
I want to be able to authenticate a user before giving him access to his account. Most of the account metadata are also encrypted with
p' to protect them from disclosure to third parties.
Edit: Further research
The SHA-2 functions are based on the Merkle–Damgård construction, which is a method of creating a hash from a block cipher. Merkle–Damgård is popular because it provably preserves specific security properties of the underlying block cipher. It does have well-known weaknesses, with some known "strengthening" strategies (used in SHA-2). The main focus of the SHA-3 competition was to find a different construction without these weaknesses.
I have not been able to find any similar security proofs of the construction of bcrypt, but I also have not been able to find any attacks against it. No one seems to be using bcrypt for any purpose other than hashing/verifying passwords.
For the purpose of a password vault, as used by the PasswordSafe V3 format, the verification of the derived key is not strictly necessary. In the V1 and V2 formats was necessary because the data had no MAC. Of course, current best practice suggests that all encryption be authenticated. Colin Percival (author of scrypt) suggests verifying the MAC before passing attacker-controlled data to ANY complicated piece of code, such as an encryption or compression function, even when such protection does not provide any cryptographic security benefit.