What quality of randomness is needed for randomized side channel countermeasures? Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES bytes) and Masking (aka blinding).
Now I wondered about where symmetric cryptographic implementations, e.g. a 4-shared masked and shuffled AES implementation, get their randomness from given that &quot;proper&quot; cryptographic randomness strategies would require computing (something like) AES again which gives us a circular dependency (?).
So my question is:
What quality of randomness is needed to secure a proper randomized cryptographic implementation and how is that randomness generated (usually)?
An optional follow-up (if not answered I will simply ask a new question): Does the randomness generator need to have the same level of protection as the main protected implementation (and thus also requires per-run randomness)?
What quality of randomness is needed to secure a proper randomized cryptographic implementation?


It is essential that the random source used is unpredictable, including under attack. If it could be predicted, or made predictable (e.g. by pouring some liquefied gaz literally freezing the random source) the countermeasure could be neutralized or even become counterproductive.
It is important that the values produced are at least about uniform and independent. A marked bias could enable an attack. How uniform and independent depends on circumstances and attacker's skill.
It is important that the source is fast, because customers hate to wait, and a lot of randomness is typically used.


How is that randomness generated (usually)?

In modern security devices, by a physical True Random Number Generator complemented by some level of monitoring and/or post-conditioning. For a typical general description of what that hardware does, see e.g. items 151 and 152 in this public Target Of Evaluation. Details are usually secret, because knowing them could help attacks. More generally, resistance to side channels is a hide and seek game, and competitive practitioners of such game don't reveals their hides.  I am told that in Common Criteria evaluation schemes, there are points for how tightly the code is kept secret.