title: py-bcrypt giving different hash results than flask-bcrypt - possible?
body: <p>I am generating a hash in a python app using the flask-bcrypt package on top of flask-security.  For a password of test12 i got a result of '$2a$12$ibinoz7sTc76Vh09shUhruYD8CrJyUxPpu1m.kb6LmFmzvWBbb52a'</p>
  
  <p>(used a randomly generated salt, per bcrypt docs)</p>
  
  <p>but when I do the following in python terminal:</p>
  
  <pre><code>import py-bcrypt
  print bcrypt.hashpw("test12", '$2a$12$ibinoz7sTc76Vh09shUhruYD8CrJyUxPpu1m.kb6LmFmzvWBbb52a')
  </code></pre>
  
  <p>I get:
  $2a$12$ibinoz7sTc76Vh09shUhru1wllZi3KqQEluhhInj5FAghM4uczmxe</p>
  
  <p>when I think I should be getting back the original as a match. I also checked with .checkpw and it returns False.</p>
  
  <p>What am I doing wrong?  Can they possibly yield different results?  My app authenticates just fine.</p>
  
  <p>UPDATE: when I manually call (in the Flask app) 
  <code>print check_password_hash('$2a$12$ibinoz7sTc76Vh09shUhruYD8CrJyUxPpu1m.kb6LmFmzvWBbb52a', 'test12')</code>
  I also get False. very strange, indeed ,considering 'test12' works to login.  If I generate a new password hash in the app, and check it using the above it passes.</p>
  
  <p>UPDATE 2: I have learned that flask-security uses HMAC, as well as the chosen password hashing backend (bcrypt, in my case) and I suspect that this my be cause of inconsistency.  Assuming that is true, the question becomes, how does one verify a password hash that has both HMAC and bcrypt applied.  My app is configured to provide a secret key as a HMAC salt (sha512) so I tried:</p>
  
  <pre><code>result = hmac.new('...my apps secretkey...', 'test12', hashlib.sha512).hexdigest()
  print bcrypt.checkpw(result, '$2a$12$ibinoz7sTc76Vh09shUhruYD8CrJyUxPpu1m.kb6LmFmzvWBbb52a')
  </code></pre>
  
  <p>But that isn't working either.</p>