NP-Complete only tells you that (if P != NP) there is no general polynomial algorithm for solving your problem. However, if the best exponential algorithm is able to, on average, break your crypto in a few minutes, then it's still not a very secure crypto system, even though it is based on an NP-Complete problem. What you are looking for in cryptography, is that the fastest you can solve a certain problem is, on average, about the same as a brute-force search. This condition can be met even if it turns out that P = NP. If the best polynomial algorithm for solving your problem is only marginally faster than a brute-force search, then your crypto system can still be considered secure.