This is by no means a replacement for HTTPS, so please do not assume that is why I am asking this question. I am exploring, and I am curious. I am looking for some expert input on this, and I am not entirely sure where I should ask this.
Okay, so say I'm sending really sensitive information (bank information for example). And I want to take a step further to protect it.
The first option would be to use asymmetric encryption alone. Encrypt the form data on submission, with the public key. And since it is public, it cannot hurt for the client to know it. Then on the server, decrypt the data with the private key. Which is obviously private, and only the server knows it.
A lot of asymmetric algorithms are really slow from what I have heard, and can be quite limited in terms of how much you can encrypt(RSA for example). So what about hybrid encryption? Encrypt the form data with symmetric encryption (random key generated every time), then encrypt the symmetric key with with the public asymmetric key. Send the symmetric key along with the data. Decrypt the key with the private key, use the key to decrypt the data.
What do you think? I am a little lost as to which would be better. And how to go about this.