This question already has an answer here:
I could not understand why in the Client hello and Server hello in SSL Handshake client needs to send to server (publicly) a random number and vice versa. From these numbers a Pre-Master secret will be generated and will be sent encrypted with server's public key. (As I see it, a random Pre-Master secret could have been generated from the beginning at client's side and be sent encrypted with server's public key)
Then, from this Pre-Master both can generate a new Master secret which will be the same in both sides.
Ok, maybe you will tell me that forward secrecy is the answer, but if man-in-the-middle records the session, he knows both random numbers, he knows the Pre-Master secret (let's say he figured out what is the server's private key), so he probably can generate the Master secret and decrypt all of the data.
So, what exactly are the purpose of these two random numbers? Why can't the client generate both 2 random numbers and send them to the server and one needs to be generated at client side while the other at server's side? Are those 2 numbers needs to be prime numbers or other thing?