diff --git a/library/constant_time.c b/library/constant_time.c
index 977971278..5bbdf1c3e 100644
--- a/library/constant_time.c
+++ b/library/constant_time.c
@@ -77,6 +77,8 @@ unsigned mbedtls_cf_uint_mask( unsigned value )
 #endif
 }
 
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
+
 size_t mbedtls_cf_size_mask( size_t value )
 {
     /* MSVC has a warning about unary minus on unsigned integer types,
@@ -91,6 +93,8 @@ size_t mbedtls_cf_size_mask( size_t value )
 #endif
 }
 
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */
+
 #if defined(MBEDTLS_BIGNUM_C)
 
 mbedtls_mpi_uint mbedtls_cf_mpi_uint_mask( mbedtls_mpi_uint value )
diff --git a/library/constant_time.h b/library/constant_time.h
index d78dd70f5..011f601ce 100644
--- a/library/constant_time.h
+++ b/library/constant_time.h
@@ -46,6 +46,8 @@
  */
 unsigned mbedtls_cf_uint_mask( unsigned value );
 
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC)
+
 /** Turn a value into a mask:
  * - if \p value == 0, return the all-bits 0 mask, aka 0
  * - otherwise, return the all-bits 1 mask, aka (size_t) -1
@@ -59,6 +61,8 @@ unsigned mbedtls_cf_uint_mask( unsigned value );
  */
 size_t mbedtls_cf_size_mask( size_t value );
 
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_TLS_CBC */
+
 #if defined(MBEDTLS_BIGNUM_C)
 
 /** Turn a value into a mask: