Question about brute force running time
When we say key size is $n$, we consider $n$ in bits, n-bit key size. For example, AES has 128, 192 and 256-bit keys sizes. Therefore, we have $2^{128}$ key to search for AES-128 and that is exponential, $ \mathcal{O}(2^n)$



In cryptography, we use also a security parameter that measures the input size of the problem.  The security parameter is represented as unary representation ( $\lambda-\text{times }1)$ so that the complexity of the cryptographic algorithms will be polynomial time.

For RSA like systems, when we say the security parameter is $1^\lambda$, the $\lambda$ represents the number of bits of RSA modulus $n$. So the positive integer $n$ must be between $0,\ldots,2^{\lambda-1}$. 

Note: We usually don't say AES (and other block ciphers) have security parameter 128, we just say 128-bit key.