The proliferation of the IoT has intensified security challenges, as resource-constrained devices remain vulnerable to cyberattacks while handling sensitive operational and personal data. Traditional cryptographic methods are often unsuitable for IoT environments because of hardware limitations, necessitating lightweight yet robust alternatives that balance efficiency with security. Existing solutions frequently struggle to address this trade-off, leaving gaps in end-to-end protection and scalability. This paper introduces a Chameleon Hash-based lightweight authentication and key exchange protocol designed for IoT architectures. The protocol facilitates mutual authentication while dynamically refreshing session keys during handshake phases, ensuring forward secrecy without additional communication rounds. By leveraging Chameleon Hash’s collision-resistant properties, our solution significantly reduces the computational overhead. We formally and informally validate the protocol’s robustness. Experimental evaluations further validate the protocol’s efficiency, achieving a computational efficiency improvement of more than 50% compared with that of state-of-the-art solutions while imposing minimal communications overhead.