Can I use a key-derivation-function as the hash function H in SRP? In the Secure Remote Password Protocol, the verifier must be stored on the server.  In the case of a server compromise, an attacker could obtain these verifiers.  If nobody reused passwords, this wouldn't be a big deal (as the users' data is probably also compromised).  However since people do reuse passwords it seems a good idea to make offline attacks against the password file difficult.

SRP is based off of a cryptographic hash H; part of the cost of an offline attack would be calculating H, so using an expensive hash for this step seems good.  However, I am unsure of the suitability of tunably expensive hashing mechanisms (e.g. PBKDF2, bcrypt, scrypt) for this.
Yes, you can and use a slow hashing function when constructing the verifier.  I would recommend using PBKDF2, as it is designed for this purpose.

In fact, Wikipedia says:


  $v$ is the host's password verifier, $v = g^x$, $x = H(s,p)$. Using of functions like PBKDF2 instead of $H$ for password hashing is highly recommended.


Thus, you could use $x=\text{PBKDF2}(s,p)$.  Alternatively, you could pre-hash the password with PBKDF2, then use the result as your $p$.