I'm going paperless, and I want to encrypt the documents that I scan. I'd like to use CommonCrypto to perform AES-XTS encryption on each file. I'm a software engineer, and I like the idea of being able to write my own wrapper around the library. However, I am not a crypto expert by any means. If I understand IVs and salting correctly, is it possible to use one long passphrase to generate a unique encryption key for each file? Also, is this general approach a good idea, or should I go in a different direction?
Yes, the principle to use a common password and a unique salt per file with a key derivation function is a good and acceptable practice, as you generate the salt randomly and with the right size. The uniqueness of the salt guarantees a different password per file (actually one password per salt, so: do not reuse a salt, use a csprng).
You forgot to mention (or to design) how you're are going to protect the cipher integrity. XTS mode does not provide this property, you should add a message authentication code (MAC) as HMAC.
It would be probably better and simpler to switch to another mode which provides confidentiality and integrity as GCM or OCB. The second reason for switching from XTS that is that mode is designed to be used in Full Disk Encryption context and encrypt disk sectors and not a whole file. some other reasons.
Don't forget to store the salt with the ciphertext and protect its integrity, too.