Good answer, thanks.

I intentionally gave you some good options (PBKDF2, bcrypt) and some really bad ones (MD5, in house) to chose from. I assume that you are using a tested and trusted library to implement PBKDF2?

But isn't the work factor - the "number or iterations" in PBKDF2 is doing the same thing as key stretching, i.e. "make the hash function very slow". There is also a similar parameter in bcrypt. So you don't need to add anything else special to the crypto, and indeed shouldn't.