My iOS app needs to store a pre-shared secret. It cannot embedded within the App Bundle itself because it could be extracted by statically analysing the bundle.
Apple's In-App-Purchase system allows an app to make a request to Apple. iOS should verify the authenticity of the app (as all apps are signed) - I realize that I could use this system to verify that the app is mine (and not an imposter trying to get the secret).
My app would make an IAP request to Apple, Apple then generates a cryptographically signed receipt and gives it back to my app, who then passes the receipt to my server which verifies Apple's signature and issues a new per-app-instance secret and returns it to the client (for storage in the iPhone Secure Enclave) where no other app can read it.
This system would break if an attacker could send their own receipts to my service. I understand the receipt contains the App Package/Bundle name which Apple asserts is correct, but I don't know how I would protect against an attacker performing a kind-of replay attack where they would get my app to make the IAP so the receipt is valid, but capture the receipt, pause my app process, then send the recipe from their app to my service (thus getting the secret).
What's a good solution to this problem, and could a jailbroken phone allow another app to masquerade itself as my app to Apple for IAPs?