diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 0e539be..61deff2 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -655,6 +655,25 @@
 //#define MBEDTLS_AES_SCA_COUNTERMEASURES
 
 /**
+ * \def MBEDTLS_AES_128_BIT_MASKED
+ *
+ * Requires MBEDTLS_AES_SCA_COUNTERMEASURES
+ *
+ * Add boolean masking against possible combined side-channel-attack fault injection attacks.
+ *
+ * Uncommenting this macro adds data, key and Sbox masking additionally to dummy rounds
+ *
+ * Tradeoff:
+ * Uncommenting this macro does not increase codesize in MBEDTLS_AES_ROM_TABLES configuration.
+ * Uncommenting this macro increases codesize in AES RAM tables configuration by ~600 byte.
+ * The performance loss is ~50% with 128 bit AES encrypt.
+ *
+ * This option is dependent of \c MBEDTLS_ENTROPY_HARDWARE_ALT.
+ *
+ */
+//#define MBEDTLS_AES_128_BIT_MASKED
+
+/**
  * \def MBEDTLS_FI_COUNTERMEASURES
  *
  * Add countermeasures against a possible FI attack.