These years Internet of Things (IoT) has been paid much attention to and the importance of lightweight and efficient authentication protocols has been increasing. In this paper, we propose a novel and flexible hash chain construction, hash chain aggregation (HCA), and a scheme to establish a common key for two users using HCA. Our proposed scheme has the following significant advantages: (1) cryptographic primitives for our scheme are hash functions only and the resultant scheme is efficient, (2) our scheme is based on a totally new hash chain construction (HCA), and (3) what two users generating a common secret key must know is only the identity (ID) of the other. No communication is required except for in the initial setting. That is, our scheme is actually an ID-based authentication protocol.