BIP461: add test vectors and reference implementation (#2328)

All vectors were tested against libsecp256k1, and
all verification vectors were checked against OpenSSL.
A check was also added to the `verify` specification
to reject pubkeys with x or y coordinates greater than
or equal to `p`.

bip-0461.md

@@ -131,6 +131,8 @@ The algorithm *verify(sig, P, msghash)* is defined as:
 
 - If *is_infinite(P)*:
   - Return *false*
+- If *x(P) >= p* or *y(P) >= p*:
+  - Return *false*
 - If *y(P)<sup>2</sup> ≠ x(P)<sup>3</sup> + 7 mod p*:
   - Return *false*
 - Let *(r, s) = sig*
@@ -200,6 +202,13 @@ Grinding requires a nonce derivation that is deterministic in the secret key and
 
 Signatures generated under this specification are normal valid signatures and will verify under existing consensus rules, and thus are fully backward compatible.
 
+## Reference Implementation
+
+For development and testing purposes, we provide a [collection of test vectors in CSV format](bip-0461/),
+a naive, highly inefficient, and non-constant time [pure Python 3.8 reference implementation of the signing and verification algorithm](bip-0461/reference.py)
+as well as the [script used to generate the test vectors](bip-0461/gen_test_vectors.py).
+The reference implementation is for demonstration purposes only and not to be used in production environments.
+
 ## Copyright
 
 This BIP is licensed under the CC0-1.0 license.