Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector? I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature:

BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt, BytesKeyGenerator ivGenerator)


I was first thinking that salting is not necessary with AES, my first idea was confirmed by this accepted Stackoverflow answer:


  Salting is generally something that is done when hashing a password, not when encrypting plaintext; for example, you would use a salt when generating a key from a password using PBEKeySpec. AES's "salt" is its initialization vector.


My question is: why does this constructor ask for a salt AND an initialization vector generator?
In short; salt is used for Key derivation function together with the password. IV is used for CBC which must be unpredictable.



In details;

The document is sparse for the details. One can guess that is is for key derivation from the supplied password and salt instead of a key. So the initial guess was it is used for key derivation from the password. When we look at the source code;

public BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt,
            BytesKeyGenerator ivGenerator) {
        super(password, salt, ivGenerator);
    }


The super class is BouncyCastleAesBytesEncryptor and there 

PBEParametersGenerator keyGenerator = new PKCS5S2ParametersGenerator();
...
keyGenerator.init(pkcs12PasswordBytes, Hex.decode(salt), 1024);


And form the documents;


  Generator for PBE derived keys and ivs as defined by PKCS 5 V2.0 Scheme 2. This generator uses a SHA-1 HMac as the calculation function.