Question

I don’t know if i am asking a silly question but I want to know whether Convert.ToBase64String function in .NET returns the same length as it’s source byte size or is it different? I wanted to try out the article from MSDN itself How To: Use Forms Authentication with SQL Server 2000 to hash my password but I found out that the function they used to create salt string is returning 3 more length than it is supposed to return. To clarify here is the code in that article.

private static string CreateSalt(int size)
{
   // Generate a cryptographic random number using the cryptographic
   // service provider
   RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
   byte[] buff = new byte[size];
   rng.GetBytes(buff);
   // Return a Base64 string representation of the random number
   return Convert.ToBase64String(buff);
}

Answer 1

The base64 encoding of a byte string is longer than the byte string because that byte string has 2^8 possibilities per “location”, while a base 64 string has only 2^6 possibilities per location (that’s why we call it base 64).

Just think of the logarithms and pigeon holes. Take the number 5000. How many locations (pigeon holes, bytes) do you need in order to store it in base 256?

"Locations in base256" = ceil(log_2(5000) / 8) = ceil(1.54) = 2

Where log_2 tells you how many bits you need. Now how many in base64?

"Locations in base64" = ceil(log_2(5000) / 6) = ceil(2.04) = 3