Index: wp-login.php
===================================================================
--- wp-login.php	(revision 5772)
+++ wp-login.php	(working copy)
@@ -183,6 +183,9 @@
 
 	// Generate something random for a password... md5'ing current time with a rand salt
 	$new_pass = substr( md5( uniqid( microtime() ) ), 0, 7);
+	// By default we now create a salted password.
+	$salt = password_salt();
+        $new_pass = $salt.md5($salt.$new_pass);
 	$wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$new_pass'), user_activation_key = '' WHERE user_login = '$user->user_login'");
 	wp_cache_delete($user->ID, 'users');
 	wp_cache_delete($user->user_login, 'userlogins');
Index: wp-includes/pluggable.php
===================================================================
--- wp-includes/pluggable.php	(revision 5772)
+++ wp-includes/pluggable.php	(working copy)
@@ -322,8 +322,27 @@
 		$error = __('<strong>ERROR</strong>: Invalid username.');
 		return false;
 	} else {
-		// If the password is already_md5, it has been double hashed.
-		// Otherwise, it is plain text.
+		if (strlen($login->user_pass) > 32 && !$already_md5){
+			// If the password is longer than a plain MD5 hash
+			// then presume that it's a salted password hash.
+			$hash = substr($login->user_pass,strlen($login->user_pass)-32,32);
+			$salt = substr($login->user_pass,0,strlen($login->user_pass)-32);
+			if (md5($salt . $password) == $hash) {
+				return true;
+			} else {
+				$error = __('<strong>ERROR</strong>: Incorrect Password.');
+				$pwd = '';
+				return false;
+			}
+		} elseif (strlen($login->user_pass) > 32 && $already_md5) {
+			// If the password is already_md5, it has been double hashed.
+	                // Otherwise, it is plain text.
+			$hash = substr($login->user_pass,strlen($login->user_pass)-32,32);
+                        $salt = substr($login->user_pass,0,strlen($login->user_pass)-32);
+			$test = md5($hash);
+			return ($test == $password);
+		}	
+
 		if ( ($already_md5 && md5($login->user_pass) == $password) || ($login->user_login == $username && $login->user_pass == md5($password)) ) {
 			return true;
 		} else {
@@ -426,9 +445,18 @@
 
 if ( !function_exists('wp_setcookie') ) :
 function wp_setcookie($username, $password, $already_md5 = false, $home = '', $siteurl = '', $remember = false) {
-	if ( !$already_md5 )
-		$password = md5( md5($password) ); // Double hash the password in the cookie.
+	$user = get_userdatabylogin($username);
 
+	if ( !$already_md5) {
+		if (strlen($user->user_pass)>32) { // Assume that the password is salted 
+		                                   // extract the hash and hash again.
+			$hash = substr($user->user_pass,strlen($user->user_pass)-32,32);
+			$password = md5($hash);
+		} else { // Unsalted passwords
+			$password = md5( md5($password) ); // Double hash the password in the cookie.
+		}
+	}
+
 	if ( empty($home) )
 		$cookiepath = COOKIEPATH;
 	else
Index: wp-includes/registration.php
===================================================================
--- wp-includes/registration.php	(revision 5772)
+++ wp-includes/registration.php	(working copy)
@@ -37,6 +37,21 @@
 }
 
 /**
+ * Generates a short random string for salting user passwords. This can 
+ * be replaced with any function that returns a string less than 32 
+ * characters in length (limitation is database field size)
+ */
+function password_salt(){
+	for($i=0;$i<4;$i++){
+		$x = rand(0,61);
+		if (0 <= $x && $x < 10 ) $salt = $salt . chr(48+$x);
+		if (10 <= $x && $x < 36) $salt = $salt . chr(55+$x);
+		if (36 <= $x && $x < 62) $salt = $salt . chr(61+$x);
+	}
+	return $salt;
+}
+
+/**
  * Insert an user into the database.
  * @global object $wpdb WordPress database layer.
  * @param array $userdata An array of user data.
@@ -54,7 +69,9 @@
 	} else {
 		$update = false;
 		// Password is not hashed when creating new user.
-		$user_pass = md5($user_pass);
+		// By default we now create a salted password.
+		$salt = password_salt();
+		$user_pass = $salt.md5($salt.$user_pass);
 	}
 
 	$user_login = sanitize_user($user_login, true);
@@ -163,7 +180,9 @@
 	// If password is changing, hash it now.
 	if ( ! empty($userdata['user_pass']) ) {
 		$plaintext_pass = $userdata['user_pass'];
-		$userdata['user_pass'] = md5($userdata['user_pass']);
+		// By default we now create a salted password.
+		$salt = password_salt();
+		$userdata['user_pass'] = $salt.md5("$salt".$userdata['user_pass']);
 	}
 
 	// Merge old and new fields with new fields overwriting old ones.
@@ -214,4 +233,4 @@
 	return wp_create_user($username, $password, $email);
 }
 
-?>
\ No newline at end of file
+?>
Index: wp-includes/user.php
===================================================================
--- wp-includes/user.php	(revision 5772)
+++ wp-includes/user.php	(working copy)
@@ -21,7 +21,15 @@
 	} else {
 		$userdata = $cache_userdata[$user_login];
 	}
-	return (md5($user_pass) == $userdata->user_pass);
+
+	$login = get_userdatabylogin($username);
+	if (strlen($login->user_pass) > 32) { // If new style salted passwords are being used
+                        $hash = substr($login->user_pass,strlen($login->user_pass)-32,32);
+			$salt = substr($login->user_pass,0,strlen($login->user_pass)-32);
+			return (md5($salt . $user_pass) == $hash);
+	} else { // Revert to unsalted passwords
+		return (md5($user_pass) == $userdata->user_pass);
+	}
 }
 
 //