Many remote-terminal to server authentication protocols use random numbers sent by the server as a challenge that the user will encrypt and send back to the server. This way an adversary cannot perform a replay attack since the number being encrypted and sent to the server (along with other parameters) is random and unknown beforehand.
But what if the adversary always records the line and maps each random number he/she ever encountered to the encrypted traffic coming after it ?
If the adversary meets a random number previously sent by the server he/she will be able to replay the traffic.
So why not use timestamp as a challenge ? A timestamp always grows and will always be different than any previous timestamp ?
Why is the use of random numbers preferable to timestamps ?
Edit: Let's say the client and server share the same password (user's password) so encrypting a future timestamp would be impossible for the replay attacker without knowing the user's password.