I'm currently implementing a small webserver on an embedded platform which is quite resource-constrained. I am planning to use unsecured communication because TLS might not be possible in my embedded environment, but nevertheless I do not want to have username / password pairs transmitted in cleartext.
I have looked at Basic Authentication which is not the best solution in terms of security as we do transmit all information, including username and password in cleartext.
Compared to Basic Authentication, Digest Authentication seems more secure but the big problem here is that the HA1 sum stored in the database must be treated as real passwords (because that's actually what they are). As soon as you get a peek at a user's HA1 sum you can get access to all areas the user can get access to as you'd be able to calculate a valid HA1 sum for every nonce the server sends.
Is there any other established authentication method that can be used in the context of HTTP while avoiding the vulnerabilities described above? Note that I only need secure authentication and not secure communication. If there isn't I might really need to reconsider using TLS in which case basic authentication would be enough.