I am trying to implement an AES encryption on my messages in my app and I want to have a different keystream for each "message group". Therefore, currently I am holding the keystreams in the database of the message groups. And the messages get decrypted by the app. However, there is one problem. The app is talking to the server via REST, and I need to get the encryption keys in a secure way. I am thinking of another keystream to encrypt the keystreams of message groups but I don't know where to keep it. Should I keep it in the app?
You should never keep keystreams. You should keep a key, and store an IV or Nonce with the ciphertext. You first need to think about where to store the key, if you store it in the same location or with the same security as your ciphertext, your scheme is meaningless.