Mark MASTG-TEST-0016 as covered by v2 (by @guardsquare)

Document/0x05e-Testing-Cryptography.md

@@ -242,3 +242,5 @@ Cryptography requires secure pseudo random number generation (PRNG). Standard Ja
 In general, `SecureRandom` should be used. However, if the Android versions below Android 4.4 (API level 19) are supported, additional care needs to be taken in order to work around the bug in Android 4.1-4.3 (API level 16-18) versions that [failed to properly initialize the PRNG](https://android-developers.googleblog.com/2013/08/some-securerandom-thoughts.html "Some SecureRandom Thoughts").
 
 Most developers should instantiate `SecureRandom` via the default constructor without any arguments. Other constructors are for more advanced uses and, if used incorrectly, can lead to decreased randomness and security. The PRNG provider backing `SecureRandom` uses the `SHA1PRNG` from `AndroidOpenSSL` (Conscrypt) provider.
+
+Check [Android Documentation](https://developer.android.com/privacy-and-security/risks/weak-prng) for details.

tests-beta/android/MASVS-CRYPTO/MASTG-TEST-0204.md

@@ -2,7 +2,7 @@
 platform: android
 title: Insecure Random API Usage
 id: MASTG-TEST-0204
-type: [static]
+type: [static, dynamic]
 mitigations:
 - android-use-secure-random
 prerequisites:
@@ -13,16 +13,18 @@ weakness: MASWE-0027
 
 ## Overview
 
-Android apps sometimes use insecure pseudorandom number generators (PRNGs) such as `java.util.Random`, which is essentially a linear congruential generator. This type of PRNG generates a predictable sequence of numbers for any given seed value, making the sequence reproducible and insecure for cryptographic use. In particular, `java.util.Random` and `Math.random()` ([the latter](https://franklinta.com/2014/08/31/predicting-the-next-math-random-in-java/) simply calling `nextDouble()` on a static `java.util.Random` instance) produce identical number sequences when initialized with the same seed across all Java implementations.
+Android apps sometimes use insecure pseudorandom number generators (PRNGs) such as [`java.util.Random`](https://developer.android.com/reference/java/util/Random), which is essentially a linear congruential generator. This type of PRNG generates a predictable sequence of numbers for any given seed value, making the sequence reproducible and insecure for cryptographic use. In particular, `java.util.Random` and `Math.random()` ([the latter](https://franklinta.com/2014/08/31/predicting-the-next-math-random-in-java/) simply calling `nextDouble()` on a static `java.util.Random` instance) produce identical number sequences when initialized with the same seed across all Java implementations.
+In general, if a PRNG is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.
+See [Android Documentation](https://developer.android.com/privacy-and-security/risks/weak-prng) and the guide on ["random number generation"](../../../Document/0x05e-Testing-Cryptography.md#random-number-generation) for details.
 
 ## Steps
 
-1. Run a static analysis (@MASTG-TECH-0014) tool on the app and look for insecure random APIs.
+1. Run a static analysis (@MASTG-TECH-0014) tool on the app and look for insecure random APIs, or you can use @MASTG-TECH-0033 to detect the use of such APIs.
 
 ## Observation
 
 The output should contain a list of locations where insecure random APIs are used.
 
 ## Evaluation
 
-The test case fails if you can find random numbers generated using those APIs that are used in security-relevant contexts.
+The test case fails if you can find random numbers generated using those APIs that are used in security-relevant contexts, such as passwords or tokens.

tests/android/MASVS-CRYPTO/MASTG-TEST-0016.md

@@ -8,6 +8,9 @@ title: Testing Random Number Generation
 masvs_v1_levels:
 - L1
 - L2
+status: deprecated
+covered_by: ['MASTG-TEST-0204', 'MASTG-TEST-0205']
+deprecation_reason: New version available in MASTG V2
 ---
 
 ## Overview