diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index f08aea5..6e7c270 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -78,6 +78,12 @@
 #error "MBEDTLS_CTR_DRBG_C and MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH defined, but MBEDTLS_CTR_DRBG_USE_128_BIT_KEY is not defined"
 #endif
 
+#if defined(MBEDTLS_AES_128_BIT_MASKED) && ( !defined(MBEDTLS_AES_SCA_COUNTERMEASURES) || \
+                                             !defined(MBEDTLS_AES_ONLY_ENCRYPT) || \
+                                             !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) )
+#error "MBEDTLS_AES_128_BIT_MASKED defined, but not all prerequisites"
+#endif
+
 #if defined(MBEDTLS_DHM_C) && !defined(MBEDTLS_BIGNUM_C)
 #error "MBEDTLS_DHM_C defined, but not all prerequisites"
 #endif
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 1ac2c81..1fc451e 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -658,18 +658,22 @@
  * \def MBEDTLS_AES_128_BIT_MASKED
  *
  * Requires MBEDTLS_AES_SCA_COUNTERMEASURES
+ *          MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+ *          MBEDTLS_AES_ONLY_ENCRYPT
  *
- * Add boolean masking against possible combined side-channel-attack fault injection attacks.
+ * Add boolean masking against possible combined side-channel-attack
+ * fault injection attacks.
  *
- * Uncommenting this macro adds data, key and Sbox masking additionally to dummy rounds
+ * Uncommenting this macro adds data, key and Sbox masking additionally
+ * to dummy rounds.
  *
  * Tradeoff:
- * Uncommenting this macro does not increase codesize in MBEDTLS_AES_ROM_TABLES configuration.
- * Uncommenting this macro increases codesize in AES RAM tables configuration by ~600 byte.
+ * Uncommenting this macro does not increase codesize in MBEDTLS_AES_ROM_TABLES
+ * configuration.
+ * Uncommenting this macro increases codesize in AES RAM tables configuration
+ * by ~600 bytes.
  * The performance loss is ~50% with 128 bit AES encrypt.
  *
- * This option is dependent of \c MBEDTLS_ENTROPY_HARDWARE_ALT.
- *
  */
 //#define MBEDTLS_AES_128_BIT_MASKED