RSA-768 has been factored by academics in 2009[0].
It has long been speculated that NSA can factor 1024bit RSA (or DHE) using custom hardware, which is why in protocols like TLS and SSH the current recommendation is for keys, certificates and Diffie Hellman key exchange to be at least as strong as RSA-2048 (e.g. 256 bit elliptic curve crypto is strong enough).
If I got the maths right, due to the exponential relationship a 760-bit key should on average take roughly 1/256th of the time a 768-bit key takes to factor.
It is stronger than the 512-bit RSA factored in the FREAK attack but is still factorable with clusters. I wonder how fast a FPGA would be able to do it.
FPGA are very very inefficient at doing anything, they are very flexible and you can program them to perform specific operations very quickly relative to general purpose hardware however most of the silicon is dedicated to facilitate the programmability of the FPGA rather than the actual processing.
If you only have access to commodity hardware than GPU's would probably be better. Xeon Phi is also insanely cheap right now and you can get a 57 core card for under or just about 200$ but I don't have clear performance data for it, i know for BC mining it's comparable to R9 290/295X or so but with much lower power consumption, but i also suspect that due to its relative low market cap it's fairly poorly optimized atm.
NSA and large private organizations use most likely specially designed hardware rather than commodity hardware and surely not FPGAs.
For private individuals the most cost effective way to factor a single key these days is probably renting EC2 GPU instances (CUDA) from Amazon @ about 70 cents and hour you should be able to factor 512bit keys for 75-150$ (based on confirmed reports).
1024 bit might also be in reach however it will require a sizable budget.
Based on the current development of "auxiliary" processing components whether it's GPU based compute cards or more traditional but highly threaded processing cards ala Xeon Phi it would not surprised me if 1024 or even 2048 bit keys will be easy to factor before 2020.
My current bet is that 1024 will be achievable on EC2 or a similar service by late 2016 to mid 2017.
NIST has disallowed 1024bit since 2014, and based on it's previous deprecation most keys were factored within 2 years after it's final deprecation notice.
It's also quite important to point that there are quite a bit of "weak" RSA keys out there and there's a good chance that the NSA and similar organizations have the capability to factor certain keys probably upto and including 2048 bit.
By "scalably factor", I was referring to their ability to take arbitrary 1024 bit public keys as they appeared in random TLS sessions on the Internet and factor them on demand.
NSA can virtually certainly target a specific, hardcoded 1024 bit key and break it. In fact, leaving out the cost and difficulty of recruiting the team to actually put the pieces together, the typical California venture capital firm has the resources to build a machine to do that today. Eran Tromer put the cost of such a machine in the single-digit millions, many years ago.
Apropos nothing: the gap between a 1024 bit key and a 2048 bit key is enormous. The thing that allows the NSA to meaningfully attack a 2048 bit key is likely to take RSA out altogether (and with it probably multiplicative finite field --- ie, "conventional" --- Diffie Hellman).
Watson Ladd has pointed out that since breaking authentication 10 years after it's been deprecated does not let you retroactively MITM someone but breaking key exchange 10 years after it's been deprecated allows decryption of stored intercepts, KEX should be stronger than certificates. So make sure your TLS server with 1024 bit key uses ECDHE or 2048 bit DHE, not plain RSA KEX.
