wpa_supplicant/Makefile is not optimized enough for target binaries size
Ivan Ivanov
qmastery16 at gmail.com
Tue Feb 3 04:56:00 PST 2026
For example, at the Makefile I see that if the internal crypto is
being used, then all the ciphers are enabled - lines 1325-1337 at
wpa_supplicant/Makefile :
CONFIG_INTERNAL_AES=y
CONFIG_INTERNAL_DES=y
CONFIG_INTERNAL_SHA1=y
CONFIG_INTERNAL_MD4=y
CONFIG_INTERNAL_MD5=y
CONFIG_INTERNAL_SHA256=y
CONFIG_INTERNAL_SHA384=y
CONFIG_INTERNAL_SHA512=y
CONFIG_INTERNAL_RC4=y
CONFIG_INTERNAL_DH_GROUP5=y
That is despite in my case of ./.config below (trying to optimize it
for target size as much as possible), for WPA2 and 802.11n, I dont
need CONFIG_INTERNAL_DES, CONFIG_INTERNAL_MD4, CONFIG_INTERNAL_SHA384,
CONFIG_INTERNAL_SHA512 and CONFIG_INTERNAL_DH_GROUP5 . Disabling them
does not stop wpa_supplicant / wpa_cli from being built and helps to
save around 10KB
# Core driver
CONFIG_DRIVER_NL80211=y
CONFIG_TLS=internal
CONFIG_CRYPTO=internal
CONFIG_CRYPTO_INTERNAL=y
# Minimal crypto needed for WPA2
CONFIG_INTERNAL_LIBTOMMATH=y
CONFIG_INTERNAL_SHA1=y
CONFIG_INTERNAL_AES=y
# Control interface
CONFIG_CTRL_IFACE=y
CONFIG_CTRL_IFACE_UNIX=y
# Disabled features for size reduction
CONFIG_NO_EAP=y
CONFIG_NO_WPS=y
CONFIG_NO_HOSTAPD_LOGGER=y
CONFIG_NO_ROBUST_AV=y
CONFIG_NO_RRM=y
CONFIG_NO_WMM_AC=y
CONFIG_NO_VLAN=y
CONFIG_NO_RADIUS=y
CONFIG_NO_ACCOUNTING=y
CONFIG_NO_BROWSER=y
CONFIG_NO_PKCS11_ENGINE_PATH=y
CONFIG_NO_PKCS11_MODULE_PATH=y
CONFIG_NO_OPENSC_ENGINE_PATH=y
CONFIG_NO_LOAD_DYNAMIC_EAP=y
CONFIG_NO_STDOUT_DEBUG=y
### CONFIG_NO_SCAN_PROCESSING=y
CONFIG_NO_ROAMING=y
CONFIG_NO_DUMP_STATE=y
CONFIG_NO_CONFIG_BLOBS=y
CONFIG_REDUCED_CODE_SIZE=y
### CONFIG_NO_WPA_PASSPHRASE=y
# Debugging
### CONFIG_DEBUG_SYSLOG=y
# Configuration backend
CONFIG_BACKEND_FILE=y
# Networking
CONFIG_LIBNL_TINY=y
# WiFi features
CONFIG_IEEE80211N=y # 802.11n (WiFi 4) - most common standard
CONFIG_HT_OVERRIDES=y # Allow HT (High Throughput) configuration
Best regards,
Ivan Ivanov
More information about the Hostap
mailing list