diff --git a/library/rsa.c b/library/rsa.c
index a233a8e..0f16a31 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -158,10 +158,12 @@
      * - OUTPUT_TOO_LARGE if the padding is good but the decrypted
      *   plaintext does not fit in the output buffer.
      * - 0 if the padding is correct. */
-    ret = mbedtls_ct_int_if(
+    ret = -(int) mbedtls_ct_uint_if(
         bad,
-        MBEDTLS_ERR_RSA_INVALID_PADDING,
-        mbedtls_ct_int_if_else_0(output_too_large, MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE)
+        (unsigned) (-(MBEDTLS_ERR_RSA_INVALID_PADDING)),
+        mbedtls_ct_uint_if_else_0(
+            output_too_large,
+            (unsigned) (-(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE)))
         );
 
     /* If the padding is bad or the plaintext is too large, zero the