While that will certainly work, given the right diode and enough light, you should realize that characterizing your photodiode as a resistor is not the way to go. Actually, it suggests that you're not using a photodiode at all, but rather an LDR (Light-Dependent Resistor). A photodiode is specified in terms of current vs optical power, and the current is more or less independent of voltage.
But either way, let's say you've got 1 to 10 mA of current going into the base of the transistor. What sort of transistor do you need?
First, the transistor should be rated for a Vceo of 5 volts or more. Vceo is the voltage from collector to emitter (with no base drive) that the transistor can withstand. This is bog-easy. As a matter of fact, it's hard to find a transistor with this low a rating.
Second, I assume you want the LED to draw 20 mA when on (from the power supply you've spec'ed). That's easy, too. The rating is Ic(max), and you'll be hard-pressed to find a transistor which won't handle that current.
Third, in order to turn the LED fully on, the transistor should drop no more than about .2 volts when fully on and conducting 20 mA. The rating here is Vce(sat) at 20 mA. (sat) here refers to saturation, which occurs when the transistor is used as a switch. Again, this is easy.
Fourth, you need to figure out the maximum amount of power the transistor will dissipate. For a transistor driving a resistor, the maximum will occur at 1/2 the maximum current, with 1/2 the maximum voltage. Since the LED drops 3 volts, the maximum voltage across the resistor/transistor combination will be 2 volts, and the maximum power point will occur with 10 mA current and 1 volt across both the resistor and the transistor. Power is voltage times current, so your worst-case power is 1 x .01, or 10 milliwatts. Again, this is easy to find.
Finally, you should think about the dark condition. If your photosensor (note that I'm not calling it a photodiode) has a dark resistance of 400,000 ohms, the base drive will be about 4 volts divided by 400,000 ohms, or 10 uA. Is this a problem? Well, if the transistor has a gain of 100, which is pretty common, the LED current will be 1 mA, which isn't exactly dark. It is possible to get Darlington transistors, which act like two transistors in series, and these can have gains in the 10,000 range. One of these will turn fully on with the sensor in the dark. So you want to be careful not to get a transistor with gain that is too high. As a matter of fact, if you want the LED to be completely off when the sensor is dark, you'll probably need to rethink your circuit.