Good question. Imagine a small microprocessor, no OS, you have HTTP and AES and SHA, but no SSL/HTTPS. Users need to configure device from browser. Very common situation. May be what @almosnow said: give each user an SD card, insert it to PC, load HTML/JS from this card, enter IP of your device and send secure messages to device. Is it possible?
Even if you put the website on a USB Drive and hand it to the client, you still have the problem of MitM - how does your client know it is talking to the server? I can send any challenge to the client and he will solve it for me. I can even use regular commands, let the client encrypt them and send the result to the server to do whatever I want...
What would be the problem then? Everything has a MitM at some point or another. What's important is to ensure that the message that went through could only be signed by the appropiate entity. "I can send any challenge to the client and he will solve it for me." No, absolutely not, that's not how things work in the web. The web doesn't push things into the browser, it's the only way around.
Even if they intercept a client request and write back a forged response (to the client) they couldn't alter it on the way to the server, or else the signature will be void. That's the point of signing.
your descriptions are quite unclear, but from what I gather, you only need signing, not encryption (" the information they send is not sensitive per se so I don't care if it goes in cleartext what I do care is to be absolutely certain that they are the ones providing the information on the other side")
so you could try OpenPGP
if you can handle delivery of USB sticks, you can deliver the OpenPGP installation together with the key
Discussion on question by almosnow: I…
Discussion on question by almosnow: I…