Generate secure password hashes without access to PBKDF2 or bcrypt
Actually you are quite near on implementing PBKDF2. It is kind of iterated HMAC execution. So have a look here and just implement the missing parts: PBKDF2