Index: wp-pass.php
===================================================================
--- wp-pass.php	(revision 19726)
+++ wp-pass.php	(working copy)
@@ -7,10 +7,16 @@
  */
 
 /** Make sure that the WordPress bootstrap has run before continuing. */
-require( dirname(__FILE__) . '/wp-load.php');
+require( dirname( __FILE__ ) . '/wp-load.php');
 
+if ( empty( $wp_hasher ) ) {
+	require_once( ABSPATH . 'wp-includes/class-phpass.php');
+	// By default, use the portable hash from phpass
+	$wp_hasher = new PasswordHash(8, true);
+}
+
 // 10 days
-setcookie('wp-postpass_' . COOKIEHASH, stripslashes( $_POST['post_password'] ), time() + 864000, COOKIEPATH);
+setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 864000, COOKIEPATH );
 
-wp_safe_redirect(wp_get_referer());
+wp_safe_redirect( wp_get_referer() );
 exit;
Index: wp-includes/post-template.php
===================================================================
--- wp-includes/post-template.php	(revision 19726)
+++ wp-includes/post-template.php	(working copy)
@@ -558,18 +558,25 @@
  * @return bool false if a password is not required or the correct password cookie is present, true otherwise.
  */
 function post_password_required( $post = null ) {
+	global $wp_hasher;
+
 	$post = get_post($post);
 
-	if ( empty($post->post_password) )
+	if ( empty( $post->post_password ) )
 		return false;
 
-	if ( !isset($_COOKIE['wp-postpass_' . COOKIEHASH]) )
+	if ( ! isset( $_COOKIE['wp-postpass_' . COOKIEHASH] ) )
 		return true;
 
-	if ( stripslashes( $_COOKIE['wp-postpass_' . COOKIEHASH] ) != $post->post_password )
-		return true;
+	if ( empty( $wp_hasher ) ) {
+		require_once( ABSPATH . 'wp-includes/class-phpass.php');
+		// By default, use the portable hash from phpass
+		$wp_hasher = new PasswordHash(8, true);
+	}
 
-	return false;
+	$hash = stripslashes( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
+
+	return ! $wp_hasher->CheckPassword( $post->post_password, $hash );
 }
 
 /**