RSA-768 factored (2009)
A team led by Thorsten Kleinjung factored RSA-768, a 232-digit number, using the number field sieve. The computation took about two years on hundreds of machines.
Demonstrated that 768-bit RSA was breakable with sufficient resources.
Contributed to the push toward 2048-bit keys as the standard minimum.
Showed the cost curve of factoring and set expectations for how quickly records would fall.
