I have an Android APK which loads in locally stored content files protected by AES encryption, and I want to keep the encryption key secret from all users. Only the app itself should be able to read the key.
My question is this: what's the current best practice for preventing all users from gaining access to the encryption key?
Options I have come across so far:
1) The encryption key is stored in the app's internal storage
2) The encryption key is hard coded into the app in a highly obfuscated form
3) The encryption key is requested by the app from a remote server which returns the encryption key over SSL. The request is authenticated by the server using an API key which itself is hard-coded into the APK (also highly obfuscated).
I'm aware that Android OS prevents apps from accessing the data of other apps (when not stored on SD card at least), so the key could possibly be stored in the app's internal storage, but I can't rely on this because users with rooted phones can simply read everything. So option 1 is out.
Neither of the remaining options offer security, just obscurity, and I'm aware that hard-coding any secret keys inside the APK is a bit of a no-no.
Option 2 at least has the benefit of being far simpler to implement.
Option 3 offers the benefit of the encryption key itself only temporarily residing in memory and is never stored permanently on the device. However an attacker would no doubt be looking at the app's response handler for any sign of the encryption key. There's that, and the API key is hard coded into the app so is discoverable by an attacker.
Are there any better options?
Edit: Regarding the use of password derived keys: the content is encrypted off-app (i.e. the app never needs to encrypt, just decrypt) using a predetermined key, so using a password derived key generated by user password/PIN is not going to work as the resulting key would not match the encryption key. Also, the UX would be adversely affected by this extra password step – we want to load and decrypt the content silently in the background if necessary.