title: Lightweight web authentication for embedded system
body: <p>I'm working on a slightly esoteric project where we need to implement some basic authentication in a small/slow embedded micro (no OS). The device serves a couple of web-pages through its serial port which then get squirted over the IP network by a bit of hardware we have no control over.</p>
  
  <p>The server code, such as it is (think <a href="http://www.ibm.com/developerworks/systems/library/es-nweb/index.html">nweb</a> on a starvation diet), takes in HTTP GET/POST requests and spits out pages &amp; changes its settings accordingly.</p>
  
  <p>We need some way of authenticating a user login/session so that we don't allow people to see data or change settings they shouldn't.</p>
  
  <p>The device is not intended to be directly exposed to the internet or be 100% impregnable to serious hacking (network security / separation is the customer's issue*), the security requirement is more about keeping the lower ranks from touching the blinkenlights ;)</p>
  
  <p>Due to the lack of space/processing power (assume we have ~2k of code space and not many MHz) we can't implement things like SSL, but it would be nice to go at least one better than the bog standard <a href="https://en.wikipedia.org/wiki/Basic_access_authentication">HTTP access control</a>.</p>
  
  <p>We can handle GET, POST and set/read cookie data. One thing our micro does have is a decent crypto-standard hardware random number generator, should that be of any help at all.</p>
  
  <ul>
  <li>= Really the customers should be hanging the device on its own network, physically disconnected or at least firewalled to death, from anything else. But hey, if it works for Boeing...</li>
  </ul>