diff --git a/eap_example/Makefile b/eap_example/Makefile
index 5c11a07d3..ae9e9f780 100644
--- a/eap_example/Makefile
+++ b/eap_example/Makefile
@@ -34,13 +34,17 @@ OBJS_both += ../src/utils/wpabuf.o
 OBJS_both += ../src/crypto/md5.o
 OBJS_both += ../src/crypto/rc4.o
 OBJS_both += ../src/crypto/md4.o
-OBJS_both += ../src/crypto/sha1.o ../src/crypto/sha1-internal.o
-OBJS_both += ../src/crypto/des.o
+OBJS_both += ../src/crypto/sha1.o
 OBJS_both += ../src/crypto/aes_wrap.o
 OBJS_both += ../src/crypto/aes.o
 OBJS_both += ../src/crypto/ms_funcs.o
 OBJS_both += ../src/crypto/sha256.o
 
+ifeq ($(CONFIG_TLS), internal)
+OBJS_both += ../src/crypto/sha1-internal.o
+OBJS_both += ../src/crypto/des-internal.o
+endif
+
 
 OBJS_both += ../src/eap_common/eap_peap_common.o
 OBJS_both += ../src/eap_common/eap_psk_common.o
@@ -124,7 +128,6 @@ CFLAGS += -DINTERNAL_AES
 CFLAGS += -DINTERNAL_SHA256
 CFLAGS += -DINTERNAL_MD5
 CFLAGS += -DINTERNAL_MD4
-CFLAGS += -DINTERNAL_DES
 ifdef CONFIG_INTERNAL_LIBTOMMATH
 CFLAGS += -DCONFIG_INTERNAL_LIBTOMMATH
 else
diff --git a/hostapd/Makefile b/hostapd/Makefile
index 6983e7a36..5b7fdca0c 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -90,7 +90,6 @@ OBJS += ../src/crypto/md5.o
 OBJS += ../src/crypto/rc4.o
 OBJS += ../src/crypto/md4.o
 OBJS += ../src/crypto/sha1.o
-OBJS += ../src/crypto/des.o
 OBJS += ../src/crypto/aes_wrap.o
 OBJS += ../src/crypto/aes.o
 
@@ -547,7 +546,7 @@ ifdef CONFIG_INTERNAL_MD4
 CFLAGS += -DINTERNAL_MD4
 endif
 ifdef CONFIG_INTERNAL_DES
-CFLAGS += -DINTERNAL_DES
+OBJS += ../src/crypto/des-internal.o
 endif
 
 ifdef NEED_SHA256
diff --git a/src/crypto/des.c b/src/crypto/des-internal.c
similarity index 99%
rename from src/crypto/des.c
rename to src/crypto/des-internal.c
index 103e59246..a4995f5fa 100644
--- a/src/crypto/des.c
+++ b/src/crypto/des-internal.c
@@ -19,9 +19,6 @@
 #include "common.h"
 #include "crypto.h"
 
-
-#ifdef INTERNAL_DES
-
 /*
  * This implementation is based on a DES implementation included in
  * LibTomCrypt. The version here is modified to fit in wpa_supplicant/hostapd
@@ -475,5 +472,3 @@ void des3_decrypt(const u8 *crypt, const struct des3_key_s *key, u8 *plain)
 	WPA_PUT_BE32(plain, work[0]);
 	WPA_PUT_BE32(plain + 4, work[1]);
 }
-
-#endif /* INTERNAL_DES */
diff --git a/src/utils/build_config.h b/src/utils/build_config.h
index 4211c04ce..0215bb58f 100644
--- a/src/utils/build_config.h
+++ b/src/utils/build_config.h
@@ -55,7 +55,6 @@
 #define INTERNAL_SHA256
 #define INTERNAL_MD5
 #define INTERNAL_MD4
-#define INTERNAL_DES
 #define CONFIG_INTERNAL_X509
 #define CONFIG_CRYPTO_INTERNAL
 #endif /* USE_INTERNAL_CRYPTO */
@@ -71,7 +70,6 @@
 #define INTERNAL_AES
 #define INTERNAL_MD5
 #define INTERNAL_MD4
-#define INTERNAL_DES
 #define CONFIG_INTERNAL_LIBTOMMATH
 #define CONFIG_INTERNAL_X509
 #define EAP_TLS_FUNCS
diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 1ae715d8f..07e60acfa 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -42,6 +42,7 @@ install: all
 	$(MAKE) -C ../src install
 
 SHA1OBJS = ../src/crypto/sha1.o
+DESOBJS = # none needed when not internal
 
 
 OBJS = config.o
@@ -51,13 +52,11 @@ OBJS += ../src/utils/wpabuf.o
 OBJS += ../src/crypto/md5.o
 OBJS += ../src/crypto/rc4.o
 OBJS += ../src/crypto/md4.o
-OBJS += ../src/crypto/des.o
 OBJS_p = wpa_passphrase.o
 OBJS_p += ../src/utils/common.o
 OBJS_p += ../src/utils/wpa_debug.o
 OBJS_p += ../src/crypto/md5.o
 OBJS_p += ../src/crypto/md4.o
-OBJS_p += ../src/crypto/des.o
 OBJS_c = wpa_cli.o ../src/common/wpa_ctrl.o
 
 -include .config
@@ -919,7 +918,7 @@ ifdef CONFIG_INTERNAL_MD4
 CFLAGS += -DINTERNAL_MD4
 endif
 ifdef CONFIG_INTERNAL_DES
-CFLAGS += -DINTERNAL_DES
+DESOBJS += ../src/crypto/des-internal.o
 endif
 
 ifdef CONFIG_IEEE80211R
@@ -1117,9 +1116,9 @@ CFLAGS += -DCONFIG_DELAYED_MIC_ERROR_REPORT
 endif
 
 OBJS += ../src/drivers/scan_helpers.o
-OBJS += $(SHA1OBJS)
+OBJS += $(SHA1OBJS) $(DESOBJS)
 
-OBJS_p += $(SHA1OBJS)
+OBJS_p += $(SHA1OBJS) $(DESOBJS)
 
 OBJS_wpa_rm := ctrl_iface.o mlme.o ctrl_iface_unix.o
 OBJS_wpa := $(filter-out $(OBJS_wpa_rm),$(OBJS)) $(OBJS_h) tests/test_wpa.o
@@ -1213,7 +1212,7 @@ test_wpa: $(OBJS_wpa) $(OBJS_h)
 
 OBJSa=../src/tls/asn1_test.o ../src/tls/asn1.o ../src/tls/x509v3.o ../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_unix.o \
 	../src/crypto/crypto_$(CONFIG_CRYPTO).o ../src/crypto/md5.o $(SHA1OBSJ) \
-	../src/crypto/rc4.o ../src/crypto/des.o ../src/crypto/aes_wrap.o \
+	../src/crypto/rc4.o $(DESOBJS) ../src/crypto/aes_wrap.o \
 	../src/crypto/aes.o ../src/tls/bignum.o ../src/tls/rsa.o
 asn1_test: $(OBJSa)
 	$(LDO) $(LDFLAGS) -o asn1_test $(OBJSa)
@@ -1222,7 +1221,7 @@ OBJSx=tests/test_x509v3.o ../src/tls/asn1.o ../src/tls/x509v3.o \
 	../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_unix.o \
 	../src/crypto/crypto_$(CONFIG_CRYPTO).o \
 	../src/crypto/md5.o $(SHA1OBJS) ../src/crypto/aes.o \
-	../src/crypto/rc4.o ../src/crypto/des.o ../src/crypto/aes_wrap.o \
+	../src/crypto/rc4.o $(DESOBJS) ../src/crypto/aes_wrap.o \
 	../src/crypto/sha256.o \
 	../src/tls/bignum.o ../src/tls/rsa.o
 test_x509v3: $(OBJSx)