The paper proposes a Physical Unclonable Function (PUF)-based mutual authentication protocol for IoT devices to overcome the resource and memory constraints of conventional cryptography and the security risks posed by a trusted third party (TTP). The PUF’s unclonable property serves as a unique “fingerprint,” allowing devices to mutually authenticate directly without storing secret keys, which thwarts cloning and database theft attacks. The scheme demonstrated resilience against machine learning (ML) and impersonation attacks (especially against simple logistic regression). The protocol was implemented on a Xilinx FPGA using a controlled True Random Number Generator (TRNG) and a lightweight hash algorithm, making it suitable for resource-constrained IoT nodes.