I need to send an Excel file to someone, normally I would use encrypted e-mail, however, this is not an option with this individual. What is the minimum length password I can apply to this file to get a decent level of protection and is there a way to mathematically compute the strength of a password?
Excel 2007 (12.0) and up uses an iterated hash and AES encryption by default if you use the native, non-backwards compatible XML format (.xlsx), so the weak point is for sure the password. Depending on how safe you need to keep the document, you can use simple passwords, or you can use more complex character sets and combinations of words. If you are using an earlier version of Office or not using the .???X file format, assume it is insecure.
The encryption process itself uses with Windows crypto provider, and the default settings are generally secure; AES 128-bit encryption in CBC mode on 4KB chunks of data, the OS random number generator for salt and IV based on that salt, and an iterated hash (at least 50000) based on SHA-1 or SHA-2, depending on the version of Office. These settings be changed, if you are concerned I would suggest checking the encrypted document, the XML format will define the type of encryption used.
For high security, I require an 80-bit strong password. If you are using random characters from the default alphanumeric 62 character set, a secure password length is 14 characters, and would be considered unbreakable by normal means, 22 characters would match the strength of AES.
If your password is NOT random characters (rather actual words or phrases), then there are methods to estimate password strength, but they can be very inaccurate, usually telling you it is stronger than it really is. Easy to remember words and phrases are generally easier to crack, the algorithms used by password cracking software are quite effective at cracking even long passwords if the password is not random.
If you need actual words, I suggest you choose at least 6 random words from the dictionary that are at least 5 characters long. You can also use the PGP wordlist, which allows you to easily use bytes from a random number generator to get them. You would need at least 10 words to be secure, and 16 to match the strength of AES. Other wordlists are acceptable, such as the diceware list, if you are aware of how much strength there is per word (12.9 bits for diceware).