I have a session key generator that uses only letters and number. I've looked up how long a session key should be here:
and by some forms of logic, it would say 20 characters at 8 bytes each is 160bits... more than enough. I read somewhere that 80 is the minimum, which would be 10 characters.
But, as I'm only using numbers and letter that means that the possible permutations are
log(2, (52 + 10) ^ 20) ~= 119 bits (52 chars + 10 nums).
So given the 128 bit key should take 292 years to guess (cited above), and mine is 9 bits less, it should take
292 / (2^9) = .57 years to guess.. I think.
This is what I think the answer to my question is:
If using all 256 utf-8 characters, 16 characters is enough to get 128 bits (recommended) and 10 is enough to get 80 bits (min).
If only using specific characters use the following function to calculate your bits and increase charCount until it's at the desired strength.
log(2, (useableChars) ^ charCount)