diff --git a/hostapd/Makefile b/hostapd/Makefile
index 4bab5cbba..55b54f599 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -190,6 +190,7 @@ ifdef CONFIG_EAP_SIM
 CFLAGS += -DEAP_SERVER_SIM
 OBJS += ../src/eap_server/eap_sim.o
 CONFIG_EAP_SIM_COMMON=y
+NEED_AES_CBC=y
 endif
 
 ifdef CONFIG_EAP_AKA
@@ -197,6 +198,7 @@ CFLAGS += -DEAP_SERVER_AKA
 OBJS += ../src/eap_server/eap_aka.o
 CONFIG_EAP_SIM_COMMON=y
 NEED_SHA256=y
+NEED_AES_CBC=y
 endif
 
 ifdef CONFIG_EAP_AKA_PRIME
@@ -220,6 +222,9 @@ endif
 ifdef CONFIG_EAP_PSK
 CFLAGS += -DEAP_SERVER_PSK
 OBJS += ../src/eap_server/eap_psk.o ../src/eap_common/eap_psk_common.o
+NEED_AES_OMAC1=y
+NEED_AES_ENCBLOCK=y
+NEED_AES_EAX=y
 endif
 
 ifdef CONFIG_EAP_SAKE
@@ -234,6 +239,7 @@ ifdef CONFIG_EAP_GPSK_SHA256
 CFLAGS += -DEAP_SERVER_GPSK_SHA256
 endif
 NEED_SHA256=y
+NEED_AES_OMAC1=y
 endif
 
 ifdef CONFIG_EAP_VENDOR_TEST
@@ -518,13 +524,20 @@ AESOBJS += ../src/crypto/aes-internal.o ../src/crypto/aes-internal-enc.o
 endif
 
 AESOBJS += ../src/crypto/aes-wrap.o
-ifndef CONFIG_NO_AES_EXTRAS
-NEED_AES_CBC=y
-AESOBJS += ../src/crypto/aes-cbc.o
-AESOBJS += ../src/crypto/aes-ctr.o
+ifdef NEED_AES_EAX
 AESOBJS += ../src/crypto/aes-eax.o
+NEED_AES_CTR=y
+endif
+ifdef NEED_AES_CTR
+AESOBJS += ../src/crypto/aes-ctr.o
+endif
+ifdef NEED_AES_ENCBLOCK
 AESOBJS += ../src/crypto/aes-encblock.o
+endif
+ifdef NEED_AES_OMAC1
 AESOBJS += ../src/crypto/aes-omac1.o
+endif
+ifdef NEED_AES_UNWRAP
 AESOBJS += ../src/crypto/aes-unwrap.o
 endif
 ifdef NEED_AES_CBC
diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index c5cc440e3..4b0ed2d36 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -320,6 +320,7 @@ OBJS_h += ../src/eap_server/eap_sim.o
 endif
 CONFIG_IEEE8021X_EAPOL=y
 CONFIG_EAP_SIM_COMMON=y
+NEED_AES_CBC=y
 endif
 
 ifdef CONFIG_EAP_LEAP
@@ -347,6 +348,9 @@ OBJS_h += ../src/eap_server/eap_psk.o
 endif
 CONFIG_IEEE8021X_EAPOL=y
 NEED_AES=y
+NEED_AES_OMAC1=y
+NEED_AES_ENCBLOCK=y
+NEED_AES_EAX=y
 endif
 
 ifdef CONFIG_EAP_AKA
@@ -361,6 +365,7 @@ OBJS_h += ../src/eap_server/eap_aka.o
 endif
 CONFIG_IEEE8021X_EAPOL=y
 CONFIG_EAP_SIM_COMMON=y
+NEED_AES_CBC=y
 endif
 
 ifdef CONFIG_EAP_AKA_PRIME
@@ -438,6 +443,7 @@ ifdef CONFIG_EAP_GPSK_SHA256
 CFLAGS += -DEAP_GPSK_SHA256
 endif
 NEED_SHA256=y
+NEED_AES_OMAC1=y
 endif
 
 ifdef CONFIG_WPS
@@ -869,12 +875,20 @@ AESOBJS += ../src/crypto/aes-internal.o ../src/crypto/aes-internal-dec.o
 endif
 
 AESOBJS += ../src/crypto/aes-unwrap.o
-ifndef CONFIG_NO_AES_EXTRAS
-NEED_AES_CBC=y
-AESOBJS += ../src/crypto/aes-ctr.o
+ifdef NEED_AES_EAX
 AESOBJS += ../src/crypto/aes-eax.o
+NEED_AES_CTR=y
+endif
+ifdef NEED_AES_CTR
+AESOBJS += ../src/crypto/aes-ctr.o
+endif
+ifdef NEED_AES_ENCBLOCK
 AESOBJS += ../src/crypto/aes-encblock.o
+endif
+ifdef NEED_AES_OMAC1
 AESOBJS += ../src/crypto/aes-omac1.o
+endif
+ifdef NEED_AES_WRAP
 AESOBJS += ../src/crypto/aes-wrap.o
 endif
 ifdef NEED_AES_CBC
diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
index fc023aac4..aaa921f27 100644
--- a/wpa_supplicant/defconfig
+++ b/wpa_supplicant/defconfig
@@ -243,11 +243,6 @@ CONFIG_CTRL_IFACE=y
 # wpa_passphrase). This saves about 0.5 kB in code size.
 #CONFIG_NO_WPA_PASSPHRASE=y
 
-# Remove AES extra functions. This can be used to reduce code size by about
-# 1.5 kB by removing extra AES modes that are not needed for commonly used
-# client configurations (they are needed for some EAP types).
-#CONFIG_NO_AES_EXTRAS=y
-
 # Disable scan result processing (ap_mode=1) to save code size by about 1 kB.
 # This can be used if ap_scan=1 mode is never enabled.
 #CONFIG_NO_SCAN_PROCESSING=y