[sses]

If the device is rooted can't the malicious app also get the encryption key?

[yareally]

Hash + salt it with bcrypt or scrypt.