diff --git a/hostapd/Makefile b/hostapd/Makefile
index f9d78a2aa..f9ee66b9b 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -528,6 +528,14 @@ ifdef CONFIG_NO_STDOUT_DEBUG
 CFLAGS += -DCONFIG_NO_STDOUT_DEBUG
 endif
 
+ifdef CONFIG_NO_AES_EXTRAS
+CFLAGS += -DCONFIG_NO_AES_UNWRAP
+CFLAGS += -DCONFIG_NO_AES_CTR -DCONFIG_NO_AES_OMAC1
+CFLAGS += -DCONFIG_NO_AES_EAX -DCONFIG_NO_AES_CBC
+CFLAGS += -DCONFIG_NO_AES_DECRYPT
+CFLAGS += -DCONFIG_NO_AES_ENCRYPT_BLOCK
+endif
+
 ALL=hostapd hostapd_cli
 
 all: verify_config $(ALL)
diff --git a/src/crypto/aes_wrap.c b/src/crypto/aes_wrap.c
index b8b79719f..b1448b0d9 100644
--- a/src/crypto/aes_wrap.c
+++ b/src/crypto/aes_wrap.c
@@ -86,6 +86,8 @@ int aes_wrap(const u8 *kek, int n, const u8 *plain, u8 *cipher)
 #endif /* CONFIG_NO_AES_WRAP */
 
 
+#ifndef CONFIG_NO_AES_UNWRAP
+
 /**
  * aes_unwrap - Unwrap key with AES Key Wrap Algorithm (128-bit KEK) (RFC3394)
  * @kek: Key encryption key (KEK)
@@ -145,6 +147,8 @@ int aes_unwrap(const u8 *kek, int n, const u8 *cipher, u8 *plain)
 	return 0;
 }
 
+#endif /* CONFIG_NO_AES_UNWRAP */
+
 
 #define BLOCK_SIZE 16