I want to develop a mobile bank app (Windows Phone, Android, iOS) that interact with a bank channel.
First time when user opens application the key exchange process begins and at end of this process a long-term
SymmetricKey generates and must store in mobile device. All of request that sends to server encrypt with this key. If someone can steal the
SymmetricKey he/she can hijack the user session. In simple way I can store
SymmetricKey in plain text format. another solution is that define a MasterKey in Code (Hardcode) and encrypt the
SymmetricKey with the
MasterKey. but in this solution there is exists exactly one
MasterKey for several instances of app that installs on different devices. If someone can decompile the mobile app code and retrieve
MasterKeyhe/she can retrieve
SymmetricKey Again, what is the best solution for store sensitive data in mobile application?
I read about some method that belongs to mobile os that guarantee that data is securely stored but all the of them needs to user set Profile Account (eg :
Unprotect() in Windows Phone that needs Hotmail account to be set).
Can I generate different master keys per different device?