diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index ad35f7b..58b2f25 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -2018,7 +2018,9 @@
 /**
  * \def MBEDTLS_CTR_DRBG_C
  *
- * Enable the CTR_DRBG AES-256-based(default) or AES-128-based random generator.
+ * Enable the CTR_DRBG AES-based random generator.
+ * The CTR_DRBG generator uses AES-256 by default.
+ * To use AES-128 instead, enable MBEDTLS_CTR_DRBG_USE_128_BIT_KEY below.
  *
  * Module:  library/ctr_drbg.c
  * Caller:
@@ -2030,16 +2032,6 @@
 #define MBEDTLS_CTR_DRBG_C
 
 /**
- * configure key size for ctr DRBG , either
- * MBEDTLS_CTR_DRBG_KEYSIZE_256 (default)
- * or
- * MBEDTLS_CTR_DRBG_KEYSIZE_128
- * must be set.
- */
-#if !defined(MBEDTLS_CTR_DRBG_KEY_SIZE_128)
-#define MBEDTLS_CTR_DRBG_KEY_SIZE_256 1
-#endif
-/**
  * \def MBEDTLS_DEBUG_C
  *
  * Enable the debug functions.
@@ -2920,6 +2912,7 @@
 //#define MBEDTLS_CTR_DRBG_MAX_INPUT                256 /**< Maximum number of additional input bytes */
 //#define MBEDTLS_CTR_DRBG_MAX_REQUEST             1024 /**< Maximum number of requested bytes per call */
 //#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT           384 /**< Maximum size of (re)seed buffer */
+//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY              /**< Use 128-bit key for CTR_DRBG - may reduce security (see ctr_drbg.h) */
 
 /* HMAC_DRBG options */
 //#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL   10000 /**< Interval before reseed is performed by default */