It's certainly not rand(). Don't use rand() for anything that needs cryptographic-quality random numbers.

On some *nix systems, you have /dev/random. Newer Intel (but not AMD, AFAIK) processor's have a hardware RNG in the CPU. Since you mentioned XP, I'm assuming you need a cross-platform solution. You might want to take a look at what GnuPG does.