I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature:
BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt, BytesKeyGenerator ivGenerator)
I was first thinking that salting is not necessary with AES, my first idea was confirmed by this accepted Stackoverflow answer:
Salting is generally something that is done when hashing a password, not when encrypting plaintext; for example, you would use a salt when generating a key from a password using PBEKeySpec. AES's "salt" is its initialization vector.
My question is: why does this constructor ask for a salt AND an initialization vector generator?