Where do the random numbers come from?

From: Bjoern (bjoern_p1_at_gmx.net)
Date: 02/10/05 

Date: Thu, 10 Feb 2005 00:34:40 +0100

Not sure if this is the best community to ask, but it is the closest I
have found. I am programming an encrypted connection between a client
and a server, and I have tried to mimic the way ssh does it (TLS) -
except that I don't use a handshake, as the protocol is already set from
the beginning. Briefly I randomly generate a key for AES, which I then
encrypt with RSA and the servers public key. The rest of the data is
being encrypted with the RSA key.

However, I feel there is a last bit of uncertainty - where do the random
  numbers for generating the AES key come from? The library I use
(BouncyCastle) just initializes the random numbers generator with the
system time. But it will only take at most a few minutes from starting
the application untill the user sends the data, so I think there are
only minutes*60*1000 combinations for an intercepting attacker to try,
which is presumably a piece of cake for modern computers :-(

So I wonder, how do common ssh implementations solve this? I have never
noticed any of these appliations (including https) ask the user to do
some random typing to generate noise?

I guess it would be better to let the server provide the random key, as
not so much would be known about the servers internal state. But I think
ssh also let's the client provide the key for the symmetric encryption?
In my application it would be difficult to let the server provide the
random key, as it would require more code on the client side, which is
limited in memory (mobile device).

Any advice would be much appreciated!

Bjoern

Relevant Pages

  • Re: Explanation of SSH
    ... I am still unclear on how SSH works exactly. ... Client issues SSH command and names server ... "Shopper" says "server sends back its public host and server keys ... Surely there is only one public key it sends ...
    (comp.security.ssh)
  • Re: ssh security question
    ... In my case - the client is a windows client and the ssh is embedded into the windows nx client. ... Is there any reason I can't run ssh-keygen on the server and copy the private key to the client - and the public key to the "authorised" directory? ... sniffer can catch your passwords, and it would make it trivial to log in ...
    (SSH)
  • Re: Trouble with X11 over SSH on Mandriva 2010.0
    ... If next clean install/update causes ssh to break, ... installed the sshd daemon/service package (OpenSSH Server) on the server. ... correct values for client and server. ...
    (comp.os.linux.networking)
  • Re: A cryptography solution for a client/server winforms app
    ... good idea if you want to learn crypto. ... you control both the client and server, you don't even need to use a ... code the client to ignore certificate trust errors. ... encrypt the memory stream. ...
    (microsoft.public.dotnet.security)
  • Re: Publishing a SSH Server
    ... Your unix box cannot reply to SSH request, ... Create a client address set for your unix box (ip address from to are the ... Jim Harrison [ISA SE] ... In that case the server is a SecureNET client but still it doesn't work.... ...
    (microsoft.public.isa.publishing)