I would question if there is really a need for such tags. Ask yourself, why are there tags?
They should primarily help people find questions they can answer. For instance, passwords is a really good tag, as it clearly encapsulates what questions will be about. Yes, there is some overlap with password-management or password-cracking, but if you feel reasonably confident in answering questions like "How do I pick a good password?" or "How should I store my passwords?", then the tag is right for you.
Likewise, random has the following usage guidance:
The generation of random or pseudorandom data, and the use of randomness in security protocols
This seems like a pretty good usage guidance to me. It's about randomness, and how to use it. Tags like prng and csprng would be quite redundant and not really help anybody.
Think to yourself, would it really make sense to make an xss tag and additionally split it into reflected-xss, stored-xss and dom-xss? No, it would just be overly complicated and make it more difficult to find interesting questions.