I know that there are already tools out there to generate cryptographic random number, but I was wondering if using AES could do the same.
For example, I have a secret key for AES on my server and a counter in my database. Each time I want to generate a random number I increment the counter then encrypt it with AES using the secret key on my server then transform the resulting bits into the right number.
Wouldn't this produce secure random number as long as my secret key is not found?
N.B.: If you want to say that storing a password on your server is not safe, please explain how it is different than storing your private SSL key on your server.
Found some info on wikipedia
A secure block cipher can be converted into a CSPRNG by running it in counter mode. This is done by choosing a random key and encrypting a 0, then encrypting a 1, then encrypting a 2, etc. The counter can also be started at an arbitrary number other than zero. Obviously, the period will be 2n for an n-bit block cipher; equally obviously, the initial values (i.e., key and "plaintext") must not become known to an attacker, however good this CSPRNG construction might be. Otherwise, all security will be lost.
So, it was used before to construct CSPRNG.