test length of bcrypt output in hashChallengeKey()