Using per-operation randomness is a popular and effective way to protect cryptographic implementations against side-channel attacks, e.g. using Shuffling (randomizing the processing order eg for AES bytes) and Masking (aka blinding).
Now I wondered about where symmetric cryptographic implementations, e.g. a 4-shared masked and shuffled AES implementation, get their randomness from given that "proper" cryptographic randomness strategies would require computing (something like) AES again which gives us a circular dependency (?).
So my question is:
What quality of randomness is needed to secure a proper randomized cryptographic implementation and how is that randomness generated (usually)?
An optional follow-up (if not answered I will simply ask a new question): Does the randomness generator need to have the same level of protection as the main protected implementation (and thus also requires per-run randomness)?