Passing statistical tests is the lowest, most basic, requirement for cryptographic RNGs. Beyond that, you need to prove that no other party (i.e., the 'attacke

Passing statistical tests is the lowest, most basic, requirement for cryptographic RNGs. Beyond that, you need to prove that no other party (i.e., the 'attacker') can predict the output any better than random chance, even if they've seen all the output leading up to it. Beyond even that, many CSRNGs attempt to recover from 'state compromise': even if a snapshot of all the contents of the secret state get leaked somehow the system will soon return to producing secure output.