In this example why do they hash a randomly generated piece of salt before hashing it with the password?

Question

From here, in the code return substr(sha1(mt_rand()),0,22); what is the point of taking the sha1 value? It is appended to the password and together they are hashed using Blowfish. Why not just append the randomly generated number?

class PassHash {  
    // blowfish  
    private static $algo = '$2a';  
    // cost parameter  
    private static $cost = '$10';  
    // mainly for internal use  
    public static function unique_salt() {  
        return substr(sha1(mt_rand()),0,22);  
    }  
    // this will be used to generate a hash  
    public static function hash($password) {  
        return crypt($password,  
                    self::$algo .  
                    self::$cost .  
                    '$' . self::unique_salt());  
    }  
    // this will be used to compare a password against a hash  
    public static function check_password($hash, $password) {  
        $full_salt = substr($hash, 0, 29);  
        $new_hash = crypt($password, $full_salt);  
        return ($hash == $new_hash);  
    }  
}  

Answer 1

They do this hashing out of a mixture of insecurity and shamanism.

The hashing has no value for actual security. Their salting is bad because mt_rand() is not sufficient to ensure uniqueness (good salts should strive to be unique, and random salts are a good way to get unique values with high probability, but it requires the use of a good random generator, in a sufficiently large space of value; and mt_rand() fails at both). Hashing the output of mt_rand() with SHA-1 gives the impression that the salt is more random than it really is; the developers must have the warm fuzzy feeling that things are safer since they "look random" to their human eyes.

Also, sprinkling hash function invocations on a given piece of code is a way to propitiate the Spirits of Cryptography. It is well-known that crypto deities look favourably upon those who use them a lot (or so many developers believe, apparently).

Answer 2

(Expanded to incorporate feedback from CodesInChaos)

To answer the "why" which is your question, i.e. in the general case of salt generation:

A salt is usually visible, it's not a secret. Simply using the random value might reveal some internal state information of the random number generator. A one-way hashing function hides that.

It is a poor substitute for a cryptographically secure PRNG. Such a PRNG will use one or more cryptographically secure hashed internally.

In this specific case it adds no value due to the low entropy output of PHP's mt_rand() (31 bits), and at worst may mislead. See also https://stackoverflow.com/questions/6618836/how-if-at-all-does-a-predictable-random-number-generator-get-more-secure-after