Please let me know if any of my assumptions are incorrect.
Say I had a database, where all of the rows of a database column is encrypted at the application level using a single passphrase, "SECRET", using password based key derivation:
Both the random salt and IV ensure that encrypting the same data for two different rows will produce different encrypted values. However, if an attacker has read access to my database and is able to brute-force the encryption of a single row, they would then know my "SECRET" passphrase and could decrypt all of the encrypted rows.
Does this mean that the main benefit in using a random salt and IV for each row is that it hides the frequency of values of my encrypted data? For example, the downside to not using a random salt and IV would be that an attacker could look at my database and see "50 rows have value X, 49 rows have value Y, and 1 row has value Z" but would not know what X, Y, and Z actually are unless they could also crack the encryption? Are there more reasons to use a random salt/IV per row?
Say I needed to query my database for the values that are encrypted. Does using a random salt and IV make the query "Give me the rows that have value N" impossible? How can I protect my data with encryption and still be able to query on it, and what kinds of common threats would I then be vulnerable to?