timeit()
However unless you deliberately using a very small key, you would need to estimate the time instead of measuring it.
Algorithms are not always linear time. For example the average time to find some factor of a random integer is much much less than the time to prove that a number is prime, or to do a prime factorization when the number is the product of two large primes. So the mean() of the time to break a cryptography might potentially be considerably less than half of the worst case.
Brute force does not always mean trying all possible keys: it can mean trying all possibilities of something else related to keys (but traditionally it does not extend to techniques such as differential analysis)
