diff --git a/configs/crypto-config-thread.h b/configs/crypto-config-thread.h
index 4ba8b5eb4..3c5fe247c 100644
--- a/configs/crypto-config-thread.h
+++ b/configs/crypto-config-thread.h
@@ -16,6 +16,8 @@
  * - no RSA or classic DH, fully based on ECC
  * - no X.509
  * - support for experimental EC J-PAKE key exchange
+ * - support for PBKDF2-AES-CMAC-PRF-128 password-hashing or key-stretching
+ *   algorithm.
  *
  * To be used in conjunction with configs/config-thread.h.
  * See README.txt for usage instructions.
@@ -25,10 +27,10 @@
 #define PSA_CRYPTO_CONFIG_H
 
 #define PSA_WANT_ALG_CCM                        1
-#define PSA_WANT_ALG_CMAC                       1
 #define PSA_WANT_ALG_ECB_NO_PADDING             1
 #define PSA_WANT_ALG_HMAC                       1
 #define PSA_WANT_ALG_JPAKE                      1
+#define PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128    1
 #define PSA_WANT_ALG_SHA_256                    1
 #define PSA_WANT_ALG_TLS12_PRF                  1
 #define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS       1
@@ -41,4 +43,5 @@
 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC    1
 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT   1
 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
+
 #endif /* PSA_CRYPTO_CONFIG_H */