Found this from a DJB paper: http://www.scs.carleton.ca/~paulv/papers/JoC97.pdf Parallel Collision Search with Cryptanalytic Applications Paul C. van Oorschot and Michael J. Wiener CHECK THE DATE: 1996 September 23 p.1 The practical significance of the technique is illustrated by giving the design for three $10 million custom machines which could be built with current technology: one finds elliptic curve logarithms in GF(2^155) thereby defeating a proposed elliptic curve cryptosystem in expected time 32 days, the second finds MD5 collisions in expected time 21 days... --- I know the dollar is not what it used to be, but same applies to hardware IMHO Metadata of the PDF is in the future, suggests windows. This is paywalled: http://link.springer.com/article/10.1007%2FPL00003816 Journal of Cryptology January 1999, Volume 12, Issue 1, pp 1-28