How to store large ordered data?

How do you securely store sensitive data on platforms such as mobile?

• Presumably a mobile app/device cannot be [completely] trusted to store cryptographic keys to a keystore or database that stores sensitive data. If so, how can you cryptographically store data so that the keys cannot be derived, most likely by decompiling the app or through MITM attacks? For example, could an authorised second party - a web server for example, maintain some secret, part of a key, so that the app itself must engage in some kind of challenge/response or handshake to get a shared key use to decrypt the database. And could this be achieved in a way which is secure? One possible solution appears to be Diffie-Hellman key exchange to get a shared key. So you would encrypt the data using a shared key, but not store that key locally and only request it from a web server when it is necessary to decrypt the data. (of course, the problem then is that the data has been decrypted as is now plaintext somewhere in memory, but I think thats another question entirely) Are there any other [better] ways of storing sensitive data on a device/app?

• Answer:

  Use a good cryptographic keystore of your own using a well respected library (ie. Bouncycastle) or write an algorithm yourself if you don't trust libraries. Have the end user type in the passphrase himself which is used with a password based key derivation function to create the key used to encrypt the keystore. In this scenario, keying material is held in the users brain. The phone contains the encrypted keystore.