The BIP32 spec says this in the security section:
Note however that the following properties does not exist:
* Given a parent extended public key (Kpar,cpar) and a child public key (Ki), it is hard to find i.
The spec doesn't say that this line is valid only for keys that are not hardened. Is this true even if the child is hardened?