I can see how a cipher can be developed using substitutions and keys, and how those two things can become more and more complex, thus offering some protection from decryption through brute-force approaches. But specifically I'm wondering:

• what other major concepts beyond substitution and key are involved?
• is the protection/secrecy of the key a greater vulnerability than the strength of the encryption?
• why does encryption still hold up when the key is 'public' ?
• are performance considerations a major obstacle to the development of more secure encryption?