The hash function is a function that allows you to utilize numerous kinds of algorithms. if you run print_r(hash_algos()); it will give you an array of the hash algorithms available on your system. Whirlpool is just one type of hash, like MD5, SHA1 and CRN32

A salt is basically adding a random string(s) to whatever you are encrypting or hashing:

php Syntax (Toggle Plain Text)

<?php
 
$sSalt = '8*S&AsEc4qUs';
$sHash = hash( 'whirlpool', $sString . $sSalt );
 
echo $sHash;

<?php $sSalt = '8*S&AsEc4qUs'; $sHash = hash( 'whirlpool', $sString . $sSalt ); echo $sHash;

so if the user decided to make their password "password" the hashed password would actually be for the value of "password8*S&AsEc4qUs" which would prevent someone from using a hash lookup database as it ensures that the users password has some form of complexity to it. This is assuming that someone was looking at the actual hash stored in the database and not trying to forge logins from a from.

I *believe* phpBB3 uses the random salt for every password option i mentioned in my previous post. It would be something like this:

php Syntax (Toggle Plain Text)

<?php
 
function getSalt( $iLength = 10 )
{
	$sPossible = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-+=[]{}|';
	$iPossibleCount = strlen( $sPossible );
 
	$sSalt = '';
	for( $i=0; $i<$iLength; $i++ )
	{
		$sSalt .= $sPossible[mt_rand(0, $iPossibleCount)];
	}
 
	return $sSalt;
}
 
$sPassword  = 'password';
$sSalt = getSalt();
 
$sHash = hash('whirlpool', $sPassword . $sSalt );
 
//Store  $sHash and $sSalt in the database.

<?php function getSalt( $iLength = 10 ) { $sPossible = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()-+=[]{}|'; $iPossibleCount = strlen( $sPossible ); $sSalt = ''; for( $i=0; $i<$iLength; $i++ ) { $sSalt .= $sPossible[mt_rand(0, $iPossibleCount)]; } return $sSalt; } $sPassword = 'password'; $sSalt = getSalt(); $sHash = hash('whirlpool', $sPassword . $sSalt ); //Store $sHash and $sSalt in the database.

Although I imagine when you get into generating random salts, you are going to be just as comparable to double hashing the same string, in terms of cpu usage and at some point you start to cross the line of security by obscurity.