I thought of asymmetric encryption here first. For each login/registration the server creates a unique public/private key pair and sends the public key to the client. The client encrypts the password with this key. Only the server which owns the private key can decrypt the password. But still authentication is missing. An attacker could eavesdrop the communication.
Without authentication, which is provided by HTTPs, it is not possible to secure the registration and login step.