Imagine a web application, where user signs up with a username and
password. If a web application generates public-private key pair at
the server and store it themselves and use it to encrypt user data, I
would say, it lost its purpose. I mean, if anyone has access to the
server's key-pairs, they can decrypt the user's data.
There are a whole class of web applications where the server has zero access (or 'zero knowledge') of the users' secrets. See protonmail.com and sync.com for a few examples.
Generally, these applications work as follows:
At registration time, a uniform random symmetric key (key1) is generated from a CSPRNG using client-side scripting running in the user's web browser. The user chooses a good password ( preferably dicewire or Bip39), and another symmetric key (key2) is derived from this password using a password based key derivation function (such as PBKDF2, Argon2, etc). Then, key1 is encrypted using key2 in-browser, then encrypted key1 is stored on the server.
When the user logs in, encrypted key1 is downloaded to the user's web browser. The user provides the password, key2 is derived from the password, and encrypted key1 is decrypted in-browser. key1 is used to encrypt all the user's secrets in-browser, so that only the encrypted secrets are uploaded to the server.
This is a slight over-simplification, because there is also a salt involved (which is stored on the server) in the password-based key derivation process. But, this is the general idea as to how web-based zero-access systems work.
d
, we don't use RSA or public-key cryptography for encryption. We prefer a hybrid cryptosystem. A randomd
in RSA makes the public exponent also random, so you dismiss the advantage of small public keys.