You can't. It is impossible to verify that the output of a purported random generator is random enough for cryptography. (It is possible to verify that it's random enough for some applications such as Monte Carlo numerical methods, but not, say, to generate a cryptographic key.)
There exist cryptographically secure pseudorandom number generators, that is, random number generators which are deterministic but nonetheless indistinguishable from truly random sequences. We don't know how to distinguish the output of a CSPRNG from a truly random sequence: given part of the output of a CSPRNG, we don't know how to reconstruct the outputs we aren't given.
(We actually can't prove mathematically that a CSPRNG exists, but there are CSPRNG built on cryptographic primitives such as AES and SHA-2, which are CSPRNG under the same hypothesis that make AES suitable to derive encryption algorithms from, and SHA-2 a cryptographic hash function.)
Since a CSPRNG is deterministic, you know its output if you know its initial state; more generally, if you know its internal state at some point, you know all subsequent outputs. Thus a CSPRNG is a suitable way to generate cryptographic keys and other random values for cryptography only if the adversary doesn't know the internal state.
A CSPRNG whose internal state is known to an adversary (not suitable for cryptography) is not distinguishable from a CSPRNG whose internal state is not known outside the smartcard (suitable for cryptography). Thus it is impossible to test the quality of an RNG from its output alone. All you can see from the output is to detect some grave flaws, but not all grave flaws.
In order to verify that an RNG does its job, it is necessary to look inside. This is done in two parts:
- Verify that the CSPRNG uses an appropriate algorithm and is implemented correctly.
- Verify that the CSPRNG is seeded from material that is not known to an adversary.
(An RNG based on physical processes alone pretty much always has detectable biases, so physical RNG are not used directly, but fed as entropy input (i.e. seed) to a CSPRNG.)
The CSPRNG implementation is validated by examining the source code, checking that the algorithm is a good one (algorithms from standards such as NIST SP 800-90A are typically prefered or even mandated), and conducting a few tests to detect implementation errors such as storing the result at the wrong address.
The seeding of the RNG is more delicate to validate. Some systems include a “true random number generator”, i.e. a piece of hardware that returns unpredicatable bits based on unpredictable physical processes such as radioactive decay or chaotic oscillators. Validating these is conducted with statistical tests that demonstrate that the output of the TRNG has sufficient entropy.
Note that the TRNG may actually not be “truly random”: it can have biases. What is important is that it is sufficiently random so that the probability of correctly predicting its next output is so low that the adversary will not be able to make an informed guess. These biases are why a CSPRNG is applied to the output of the TRNG: the use of a cryptographic “mixing” function turns observable correlations (e.g. if a bit is 0 then the next bit has a 52% chance of also being 0) into correlations that are impossible to calculate.
It is also possible to make an RNG by seeding the CSPRNG once and for all with a secret value. This is viable only you are sure that the internal state of the PRNG will not leak out. The seed value itself must be generated randomly, ultimately from some form of TRNG; but this way, the TRNG can be in the factory, rather than in the device where the RNG runs.
As a purchaser of smartcards, you cannot look inside to see what the card is doing. (Not being able to look inside is an important property of smartcards.) However, the card you're using may have been evaluated by a security laboratory. There are standards to evaluate the security of smartcards, such as Common Criteria
protection profiles. You can check if your card has been certified. CC aren't the only such certification; credit card companies such as Visa and Mastercard have their own certification process. If the card has been evaluated, your vendor should point you to the certificate — it's a marketing argument. There are many smartcard certifications and they test different things, so check exactly what the certificate guarantees. You won't find out exactly how the RNG works (that's usually a trade circuit), but you'll know that a security laboratory looked into it and found no flaw.