Scrypt isn't an option on memory constrained devices.
Also, it's not a good idea to base your security parameters on the compute power of the most underpowered device in the chain.
That being said, for these cases you could use Argon2 which is mostly (entirely?) based on ARX constructs and will work well on embedded/underpowered devices
There are also some symmetric encryption shenanigans that can be done, but if you can use something other than password-based auth you're free from pretty much all of these problems, with probably much better security