It sounds like you're using a password-based key derivation function that accepts an optional salt input to convert a passphrase into an encryption key, which you then use to encrypt messages with a block cipher mode (or possibly some other type of stream cipher) that takes an IV or a nonce, and you want to know whether it's necessary to provide a salt to the KDF, given that you're encrypting every message with a unique IV.
In general, the answer is "possibly, but at least using both won't hurt."
An IV and a salt really have two completely different security goals. An IV is used as part of the encryption process, and its main purpose is to allow the same key to be securely used to encrypt multiple messages.* If the same key and IV are used to encrypt more than one message, inspecting the ciphertexts can leak some information about the plaintexts.
(The exact information leaked depends on the cipher mode: for CBC and CFB modes, it includes the length of any common prefix shared by the messages, and possibly some information about the first cipher block that differs; for CTR and OFB modes, reusing the IV leaks the bitwise XOR of the full messages!)
A salt, on the other hand, is used in the key derivation process,** and its main purpose is to slow down certain kinds of brute-force password cracking attacks by, on one hand, ensuring that two users with the same passphrase won't end up with identical keys, and on the other hand, preventing attackers from precomputing passphrase/key combinations in advance.
(Some KDFs may also use the salt to allow multiple quasi-independent keys to be derived from the same passphrase, while other KDFs have a separate parameter for that. Similarly, some cipher modes may also have additional requirements on the IV; for example, CBC mode needs an IV that is not only unique but also unpredictable to resist certain chosen-plaintext attacks.)
In particular, a password-based key derivation function should implement key stretching, i.e. it should be deliberately resource-intensive to compute in order to slow down brute force attacks. Including a unique salt in this process is important, because it prevents an attacker from gaining a significant advantage by targeting multiple users in parallel.
Without a salt, an attacker could just run the slow key-derivation process once for each password, and then quickly test the resulting key against every captured message. Salting the KDF forces the attacker to instead repeat the slow key derivation process for each user / message separately. An IV will not help here, since it's applied only during the encryption step, after the slow key derivation process is over.
IVs don't really have any effect on brute-force password guessing attacks like this; the kind of attacks prevented by proper IV usage are plaintext-recovery (not key-recovery) attacks based on reusing the same key and IV to encrypt multiple message, which can leak information about the plaintexts for those messages.
Note that, if you're only encrypting a single message with each key produced by your KDF, then you may be able to safely use a fixed IV. But in that case, you definitely need to use a per-message salt in your KDF, to guarantee that the keys will really be unique. In any case, even if not strictly necessary in this case, using a random unique IV is still the safe default choice.
Ps. In any case, you really should be using an authenticated encryption mode instead of plain CBC to protect against active tampering attacks. Among such modes, I'd like to particularly mention SIV mode (RFC 5297), which is designed to offer extra resistance against accidental IV reuse.
*) At least, that's true of the kind of IVs we're talking about here. More generally, the term "IV" really just means "initialization vector", and is used for all sorts of algorithms, like hash functions, that involve iteratively processing blocks or "vectors" of data. Alas, the terminology is probably too entrenched to change at this point.
**) Salts are also used for password hashing in password-based authentication schemes. Actually, password hashing and key derivation are very similar tasks, and so the algorithms and terminology are mostly the same.
Related links:
So, if you are using PBE with AES in CBC mode as the underlying cipher, you would expect to have to send both a PBE salt and a CBC IV along with the encrypted data
, also this question of difference and need of the too came when I was searching for symmetric encryption in c# (link- stackoverflow.com/questions/202011/encrypt-and-decrypt-a-string) and here too both the salt and IV were used for a single encryption... $\endgroup$