Correct and secure manner of storing in-app-purchases

Question

What is the best way to store an in-app-purchase on a device, so that the purchases can also be accessed offline but the security of the purchases are not compromised?

Answer 1

Do not store anything valuable on the device as it cannot be trusted and it can easily be compromised by someone motivated.

Now, all of this depends on the type and value of the item that is being purchased and what happens if its compromised.

If its truly valuable then use a remote secure server for managing secure items. In app purchases include a receipt that can be verified by your remote secure server talking to apple's servers directly through a secure connection. See this link to verifying store receipts.

Answer 2

As far as I know, the most convenient way to securely store a purchased asset would be to use some form of encryption.

The user should be able to download an encrypted asset, and the app should decrypt it on the fly.

However, make sure that you store the key in a secure fashion as well, as string keys (within the app binary) can easily be recovered by a skilled hacker. A good way to secure the key would be to use some sort of authentication with a server-based system. The app would get the key off the server and keep it only for the few moments required to decrypt the asset.

This defense mechanism is not impregnable; I feel that it is sophicaticated enough to discourage most users from attempting to undermine it.

To decrypt your assets on the device, a good idea would be to use CommonCrypto. It's provided by Apple (with the iOS SDK), so you don't have to build it from scratch and you don't have to provide documentation (required by US law) for your app. I find Jim Dovey's Common Crypto wrapper the easiest way to use it.

Hope that helps. :)