Does Convert.ToBase64String return the same length as it's source byte array ?

Question

I don't know if i am asking a silly question but I want to know whether Convert.ToBase64String function in .NET returns the same length as it's source byte size or is it different? I wanted to try out the article from MSDN itself How To: Use Forms Authentication with SQL Server 2000 to hash my password but I found out that the function they used to create salt string is returning 3 more length than it is supposed to return. To clarify here is the code in that article.

private static string CreateSalt(int size)
{
   // Generate a cryptographic random number using the cryptographic
   // service provider
   RNGCryptoServiceProvider rng = new RNGCryptoServiceProvider();
   byte[] buff = new byte[size];
   rng.GetBytes(buff);
   // Return a Base64 string representation of the random number
   return Convert.ToBase64String(buff);
}

Answer 1

No, Base64 returns 4 bytes output for 3 bytes input, rounded up (padded with =) to the next 4-byte boundary.

int outputLength = ((inputLength+2)/3)*4

That's because it only uses 6 bits (basically a number 0-63) per byte in order to only use ASCII chars which are not control chars and in the 7-bit range. Therefore, you get 3*8 => 4*6 bits when encoding data with Base64.

Answer 2

base-64 rarely returns a string of the same length as the input. Essentially, it is only using 6 of the available 8 bits, so large messages (in particular) will require an extra 1/3 volume. There are a few packing bytes (usually "=") at the end to make the message unambiguous.

Answer 3

The base64 encoding of a byte string is longer than the byte string because that byte string has 2^8 possibilities per "location", while a base 64 string has only 2^6 possibilities per location (that's why we call it base 64).

Just think of the logarithms and pigeon holes. Take the number 5000. How many locations (pigeon holes, bytes) do you need in order to store it in base 256?

"Locations in base256" = ceil(log_2(5000) / 8) = ceil(1.54) = 2

Where log_2 tells you how many bits you need. Now how many in base64?

"Locations in base64" = ceil(log_2(5000) / 6) = ceil(2.04) = 3