title: Secure keys in iOS App scenario, is it safe?
body: <p>I am trying to hide 2 secrets that I am using in one of my apps.</p>
  
  <p>As I understand the keychain is a good place but I can not add them before I submit the app.</p>
  
  <p>I thought about this scenario -</p>
  
  <ul>
  <li>Pre seed the secrets in my app's CoreData Database by spreading them in other entities to obscure them. (I already have a seed DB in that app).</li>
  <li>As the app launches for the first time, generate and move the keys to the keychain.</li>
  <li>Delete the records from CoreData.</li>
  </ul>
  
  <p>Is that safe or can the hacker see this happening and get those keys?</p>
  
  <p>*THIRD EDIT**
  Sorry for not explaining this scenario from the beginning - The App has many levels, each level contains files (audio, video, images). The user can purchase a level (IAP) and after the purchase is completed I need to download the files to his device.</p>
  
  <p>For iOS6 the files are stored with Apple new "Hosted Content" feature. For iOS5 the files are stored in amazon S3.</p>
  
  <p>So in all this process I have 2 keys:
  1. IAP key, for verifying the purchase at Apple IAP.
  2. S3 keys, for getting the files from S3 for iOS5 users:</p>
  
  <pre><code>NSString *secretAccessKey = @"xxxxxxxxx";
  NSString *accessKey = @"xxxxxxxxx";
  </code></pre>
  
  <p>Do I need to protect those keys at all? I am afraid that people will be able to get the files from S3 with out purchasing the levels. Or that hackers will be able to build a hacked version with all the levels pre-downloaded inside.</p>