where to keep the AES keystream? I am trying to implement an AES encryption on my messages in my app and I want to have a different keystream for each "message group". Therefore, currently I am holding the keystreams in the database of the message groups. And the messages get decrypted by the app. However, there is one problem. The app is talking to the server via REST, and I need to get the encryption keys in a secure way. I am thinking of another keystream to encrypt the keystreams of message groups but I don't know where to keep it. Should I keep it in the app?
You should never keep keystreams. You should keep a key, and store an IV or Nonce with the ciphertext. You first need to think about where to store the key, if you store it in the same location or with the same security as your ciphertext, your scheme is meaningless.

Check this answer I just created on Stackoverflow, and learn about key management. This answer on the Information Security site also seems very on topic for you.