You don't absolutely have to do both, but by doing the parameter handling you are sending another signal to Google of what you want them to do (keep in mind that both canonical and parameters are only considered suggestions by Google). It's pretty simple to setup the parameter handling, so if you are really concerned about the duplicate content issues, why not do both?
Also, technically, the canonical tag tells Google which URL they've crawled to give prominence to when they are duplicate content, whereas my understanding is that parameter handling (when Google follows your suggestions) actually prevents Google from even crawling URLs with those parameters. In other words, canonical tags tell Google what to do with URLs they've crawled and parameter handling tells Google what URLs not to even crawl.