> If either the key or salt values are all 0s then the encryption does nothing. AES for comparison will still encrypt your data with some level of security even if the IV initialisation is not perfectly random or skipped.

Not experienced in this field but this seems like a good thing to me. Even just using crypto properly appears to be hard, and this 'do nothing when given 0' trait makes the vulnerability very obvious to a quick basic security examination (or even just looking at it in Wireshark), vs needing an expert to do lengthy analysis and figure out that you subtly fucked up the AES initialization and had been running unsafe code for years.