# finding sha256 preimage or secp256k1 private key, which is harder?

Is finding a public key that matches hash of pre-commited public key (second layer security) more computationally hard than finding private key to a known public key (attacking secp256k1)?

For SHA-256, the best known attack is to simply try lots of images until you stumble across one which hashes to the value you're looking for; that takes an expected $$2^{256}$$ hashes.
For Secp256k1, there are several known generic attacks (Big-Step-Little-Step, Pollard Rho) which reduces the expected complexity of finding the private key to about $$2^{128}$$ point additions.
Even though a point addition is considerably more expensive than computing a hash, it's not $$2^{128}$$ times as expensive, and so attacking secp256k1 is the easier option.
On the other hand, $$2^{128}$$ point additions is far more than is possible with current hardware (even if you had truly massive amounts of computational resources), and so it is safe.