This Factorization of a 768-bit RSA modulus, http://eprint.iacr.org/2010/006.pdf http://eprint.iacr.org/2010/006.pdf, is the paper linked to by Bruce; I didn't

This Factorization of a 768-bit RSA modulus, http://eprint.iacr.org/2010/006.pdf http://eprint.iacr.org/2010/006.pdf, is the paper linked to by Bruce; I didn't want to link it as the main link because it's a pdf (and the comments on Schneier are usually very worth reading).