Our current HMAC formats are "salt is message, password is key".
I always forget which it is, so add this to algorithm name. We
could/should implement "salt is key, password is message" too.