What security differences are there between E(p',"well-known-plaintext") vs. hash(p') where p'=KDF(p) I am using a KDF to derive a key, p' from a password p. I would like to know if the password is correct before using the derived key.

Bruce Schneier's PasswordSafe format V3 has 


  H(P') is SHA-256(P'), and is used to verify that the user has the correct passphrase.


I understand that bcrypt uses the derived key with Blowfish to encrypt "OrpheanBeholderScryDoubt" 64 times to create a password hash. (edit: I am not concerned specifically about Blowfish, but about any block cipher used in this manner. Bcrypt is just an example.)

Question: 

Is there any difference in the security of these two approaches to verifying a password?

Context:

I want to be able to authenticate a user before giving him access to his account.  Most of the account metadata are also encrypted with p' to protect them from disclosure to third parties.



Edit: Further research

The SHA-2 functions are based on the Merkle–Damgård construction, which is a method of creating a hash from a block cipher. Merkle–Damgård is popular because it provably preserves specific security properties of the underlying block cipher. It does have well-known weaknesses, with some known "strengthening" strategies (used in SHA-2). The main focus of the SHA-3 competition was to find a different construction without these weaknesses.

I have not been able to find any similar security proofs of the construction of bcrypt, but I also have not been able to find any attacks against it. No one seems to be using bcrypt for any purpose other than hashing/verifying passwords.

For the purpose of a password vault, as used by the PasswordSafe V3 format, the verification of the derived key is not strictly necessary. In the V1 and V2 formats was necessary because the data had no MAC.  Of course, current best practice suggests that all encryption be authenticated. Colin Percival (author of scrypt) suggests verifying the MAC before passing attacker-controlled data to ANY complicated piece of code, such as an encryption or compression function, even when such protection does not provide any cryptographic security benefit.
It is important to make sure that password based key derivation takes place before passphrase correctness is checked. Otherwise, possible attacker can choose if they attack against passphrase correctness check or pbkdf function.
(Appears ok on the both functions.)

PasswordSafe
In case of very high entropy key, it theoretically could be possible that for instance SHA-256(P') would be easier to break than the key. However, for any typical passwords, expected amount of entropy is (possibly) between 10 and 80 bits, and thus the passwords are likely weaker than the hash. (Thus appears ok.)

bcrypt
I don't like decision to use blowfish encryption in crypt. This is because cryptographic key should usually be used only for very small (preferably one) purpose. The use in blowfish algorithm &quot;consumes&quot; allowed key uses. Maybe blowfish is the weakest link?


Overall, it seems that both choices should appear good enough for common practice, but I think the PasswordSafe's choice of SHA-256 appears even more conservative and secure. However, using SHA-256 appears extraneous as well.