# Why BouncyCastleAesCbcBytesEncryptor is using a salt and an initialization vector?

I'm using the class BouncyCastleAesCbcBytesEncryptor from Spring Security. One of the constructor has the following signature:

BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt, BytesKeyGenerator ivGenerator)


I was first thinking that salting is not necessary with AES, my first idea was confirmed by this accepted Stackoverflow answer:

Salting is generally something that is done when hashing a password, not when encrypting plaintext; for example, you would use a salt when generating a key from a password using PBEKeySpec. AES's "salt" is its initialization vector.

My question is: why does this constructor ask for a salt AND an initialization vector generator?

In short; salt is used for Key derivation function together with the password. IV is used for CBC which must be unpredictable.

In details;

The document is sparse for the details. One can guess that is is for key derivation from the supplied password and salt instead of a key. So the initial guess was it is used for key derivation from the password. When we look at the source code;

public BouncyCastleAesCbcBytesEncryptor(String password, CharSequence salt,
BytesKeyGenerator ivGenerator) {
}


The super class is BouncyCastleAesBytesEncryptor and there

PBEParametersGenerator keyGenerator = new PKCS5S2ParametersGenerator();
...

To sum up, BouncyCastleAesCbcBytesEncryptor derives a key from your password and your salt (which should be random, or at least change for each password you use), and generate an IV given your ivGenerator for each new encryption (a random IV is generated for each encryption, for security matter).