"A cipher is secure ⇒ brute force is impossible. Impossible brute force is necessary but NOT sufficient for security."

Breaking this down:

• Forward (⇒): If a cipher is secure, then a brute force attack must be infeasible. This is obvious — if you could brute-force it, it wouldn't be secure.
• Reverse (⇐ does NOT hold): Just because brute force is impossible does NOT mean the cipher is secure. There might be mathematical shortcut attacks (differential cryptanalysis, linear cryptanalysis, etc.) that break it without trying every key.

Practical meaning: When evaluating a cipher, checking that brute force is infeasible is the minimum requirement, but you must also verify resistance against mathematical (analytical) attacks.

Tip: Think of a house: having a strong front door (impossible brute force) is necessary, but if the windows are open (mathematical weakness), the house isn't secure.

Go deeper:

• Brute-force attack (Wikipedia) — why resisting brute force is necessary but not sufficient for security.

Classical cryptanalysis (mathematical + brute force), implementation attacks (side channels), and social engineering.

* The three branches of cryptanalysis — classical (mathematical + brute-force), implementation attacks, and social engineering. *

The taxonomy:

Cryptanalysis
├── Classical Cryptanalysis
│   ├── Mathematical Cryptanalysis
│   │   (differential, linear, algebraic attacks)
│   └── Brute-Force Attacks
│       (exhaustive key search, table lookup)
├── Implementation Attacks
│   (side channel attacks, fault injection, timing attacks)
└── Social Engineering
    (phishing, bribery, coercion)

Key insight: Even a mathematically perfect cipher can be broken through implementation flaws (power analysis, timing leaks) or by simply tricking/threatening the key holder. Cryptanalysis is broader than just math.

Go deeper:

• Cryptanalysis (Wikipedia) — the full landscape of attacks, from mathematics to side channels.