test: cross-check RPO test vectors with Python reference implementation

[Farukest]

Summary

After the state layout change in #755 ([CAPACITY, RATE0, RATE1] → [RATE0, RATE1, CAPACITY]), the RPO test vectors were updated but not verified against the reference implementation.

This PR adds a Python verification script adapted from the original RPO reference that uses the current state layout and confirms all 19 test vectors match the Rust implementation.

• Add generate_test_vectors.py implementing RPO hash with the current layout
• All 19 vectors verified: python3 generate_test_vectors.py → all OK
• Add doc comment on EXPECTED noting the cross-check

Closes #768

Test plan

• python3 generate_test_vectors.py — 19/19 vectors match
• cargo test -p miden-crypto hash_test_vectors — passes
• cargo +nightly fmt --check
• cargo clippy -p miden-crypto
• cargo doc -p miden-crypto --no-deps

[Al-Kindi-0]

Just to double, check the .py implementation is exactly the reference one, except for the state re-mapping, right?
Otherwise looks great to me, thank you@

[Farukest]

Just to double, check the .py implementation is exactly the reference one, except for the state re-mapping, right? Otherwise looks great to me, thank you@

Not exactly
The permutation itself (MDS, sbox, inv_sbox, round constants, round structure) is identical to the reference. But the hash function wrapper has two additional differences beyond the state re-mapping:

1. Domain separation uses len % rate (as in our Rust code) instead of the reference's binary 0/1 flag
2. Padding uses only zeros instead of the reference's [1, 0, ...]

Both of these match our Rust implementation which follows the padding rule from the 2023/1045 paper rather than the original reference. The 19 test vectors confirm it's consistent with our Rust code

[Al-Kindi-0]

Just to double, check the .py implementation is exactly the reference one, except for the state re-mapping, right? Otherwise looks great to me, thank you@

Not exactly The permutation itself (MDS, sbox, inv_sbox, round constants, round structure) is identical to the reference. But the hash function wrapper has two additional differences beyond the state re-mapping:

1. Domain separation uses `len % rate` (as in our Rust code) instead of the reference's binary 0/1 flag

2. Padding uses only zeros instead of the reference's `[1, 0, ...]`

Both of these match our Rust implementation which follows the padding rule from the 2023/1045 paper rather than the original reference. The 19 test vectors confirm it's consistent with our Rust code

Thank you! Indeed, the padding rule has changed from the one that was used in the RPO paper.

[huitseeker]

This is a nice verification script. Since the Python script isn't part of CI, a future change to RPO could break consistency without detection. Would be worth considering either adding this to CI or generating test vectors from Python as the source of truth.

[bobbinth]

I wouldn't spend effort on this right now as with v0.21 VM, we no longer use RPO/RPX and we may be dropping RPO/RPX from this repo in the near future.

[bobbinth]

Looks good! Thank you.

This was a fairly low priority issue as RPO/RPX may be dropped from this repo soon. But since the work has already been done, I'll merge it.

[bobbinth]

I wouldn't spend effort on this right now as with v0.21 VM, we no longer use RPO/RPX and we may be dropping RPO/RPX from this repo in the near future.