Randomness tests mean extremely little for cryptographic PRNGs [1]. Passing a statistical test basically just means that your RNG isn't horribly, awfully broken

Randomness tests mean extremely little for cryptographic PRNGs [1]. Passing a statistical test basically just means that your RNG isn't horribly, awfully broken. Such tests mean almost nothing in terms of cryptographic security. A statistical test just determines if the output of a PRNG "looks random" from a very, very narrow point of view, typically not algorithm-specific and often predefined ahead of time. Cryptographic security, on the other hand, requires defending against an intelligent adversary who actively seeks to subjugate and compromise the unpredictability of the specific PRNG in question. As an example, the Mersenne Twister passes many of the popular statistical tests with flying colors, but learning 624 consecutive values from it allows an attacker to reconstruct its internal state and predict all future values. (That is, it's totally worthless when it comes to cryptographic security.) [1] http://security.stackexchange.com/a/32416/1373 http://security.stackexchange.com/a/32416/1373