Abstract: Radio frequency identification (RFID) is becoming ubiquitous at present, which is suitable for ubiquitous computing environment. Its flexibility holds great promise for novel applications, and increasingly RFID tags are being deployed. RFID security and privacy is the basic requirement in most applications. Conventional security primitives cannot be integrated in RFID tags as they have inadequate computation capabilities with extremely limited resources. Therefore, it is important to have some lightweight security mechanisms suitable for RFID tags. A tagged item will be often passed to a new owner. The privacy of the new (as well as the past) owner should be guaranteed. Based on SQUASH—a message authentication code (MAC) with provable security properties for highly constrained devices, a new lightweight ownership transfer protocol is proposed. The new protocol has more efficient performance than other Hash-based schemes. Moreover, it achieves very strong notion of security and it is the first protocol based on SQUASH whose security properties have been proven. Finally, the new protocol can protect the forward and backward privacy of both parties that is very important requirement in the ownership transfer application.