Just pick a real password hash and dial up the hardness as high as you reasonably can for your environment. Don't do anything more complicated than that.