TLWSD v0.06 Password upgrade

<?
/*
 * This is what the old password hashing looked like for This Link Will Self Destruct:
 */
$passhash = substr(hash('sha512', $_POST['password']), 0, 64);
/*
 * It's pretty okay, and it served its purpose (being a comparison value that's independent of
 * the encryption key and IV, but related in that all three come from the $_POST['password']
 * variable. But it could be better. Now, it looks like this:
 */

  $cost = floor(10 + ((date('Ym') - 201204)/30)); // Increase by 1 every 30 months
                                           // to conform to Moore's Law
  $random = convBase(raw2hex(openssl_random_pseudo_bytes(33)), '0123456789abcdef', './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz');
  if($random{23}) $random = substr($random, 0, 22);
  $salt = "\$2a\${$cost}\${$random}";
  $passhash = substr(hash('sha512', $_POST['password']), 0, 64); // Step 1: Part of SHA512
  for($i = 1; $i <= 1000; $i++) { // Step 2: HMAC-SHA256 with an increasing key
    $passhash = hash_hmac('sha256', $_POST['password'].$passhash, $i);
  }
  $passhash = crypt($passhash, $salt); // Bcrypt the final result -- new feature!
/*
 * At first, a random 136-bit salt (converted to the CRYPT_BLOWFISH compatible base64) truncated
 * to 22 characters is generated.
 *
 * The comparison value is initially hashed the same way as the old one (SHA-512-LEFT). However,
 * it is now also fed through a loop of hash_hmac('sha256') calls. The original password is
 * prepended to the preceding hash for the data part of the HMAC algorithm. An increasing counter
 * from 1 to 1000 is used as the HMAC key.
 *
 * The final result is passed to bcrypt for storage. Decryption code looks slightly different,
 * due to the if($stored == crypt($userSupplied, $stored) approach to crypt() that PHP uses,
 * but its effect is essentially the same.
 *
 * The cost parameter is set to 10 for April 2012 and increases by 1 every 30 months. (Current
 * estimates for Moore's Law set the doubling time of processing power to 2-3 years. I went with
 * the middle-ground. Feel free to adjust for your implementation.)
 */
?>

That about covers all the weirdness from v0.05 to v0.06 of TLWSD