Digital sign HTML form data before sending it to server? I need to encrypt and digital sign an html form that contains sensitive data. The legal need is that the user can't deny that he filled the form and the data sent was not altered.

I was thinking to generate server side RSA public key and private key, and I will store the public key in  the database with a technical id.

Then I send the private key to the html page (ajax call or at load). The Javascript code will encrypt the form before sending it. The Javascript will send the encrypted data and the public key id so i can retrieve it server side and can decrypt it.

Is it the good approach, or do you see any security issues?
Is it the good approach?


No, it is not. You say you want to do this for legal reasons. If your server knows the private key (as it does in this case), the server or anyone with access to the server will also have access to the private key and can therefore sign any form they want. Therefore, your proposal does not meet your goals.