- Major type rewrite of int to size_t for most variables and arguments used for buffer lengths and loops
diff --git a/include/polarssl/aes.h b/include/polarssl/aes.h
index 40b3a56..4b97568 100644
--- a/include/polarssl/aes.h
+++ b/include/polarssl/aes.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_AES_H
 #define POLARSSL_AES_H
 
+#include <string.h>
+
 #define AES_ENCRYPT     1
 #define AES_DECRYPT     0
 
@@ -57,7 +59,7 @@
  *
  * \return         0 if successful, or POLARSSL_ERR_AES_INVALID_KEY_LENGTH
  */
-int aes_setkey_enc( aes_context *ctx, const unsigned char *key, int keysize );
+int aes_setkey_enc( aes_context *ctx, const unsigned char *key, unsigned int keysize );
 
 /**
  * \brief          AES key schedule (decryption)
@@ -68,7 +70,7 @@
  *
  * \return         0 if successful, or POLARSSL_ERR_AES_INVALID_KEY_LENGTH
  */
-int aes_setkey_dec( aes_context *ctx, const unsigned char *key, int keysize );
+int aes_setkey_dec( aes_context *ctx, const unsigned char *key, unsigned int keysize );
 
 /**
  * \brief          AES-ECB block encryption/decryption
@@ -101,7 +103,7 @@
  */
 int aes_crypt_cbc( aes_context *ctx,
                     int mode,
-                    int length,
+                    size_t length,
                     unsigned char iv[16],
                     const unsigned char *input,
                     unsigned char *output );
@@ -121,7 +123,7 @@
  */
 int aes_crypt_cfb128( aes_context *ctx,
                        int mode,
-                       int length,
+                       size_t length,
                        int *iv_off,
                        unsigned char iv[16],
                        const unsigned char *input,
diff --git a/include/polarssl/arc4.h b/include/polarssl/arc4.h
index 2344c74..48ad60b 100644
--- a/include/polarssl/arc4.h
+++ b/include/polarssl/arc4.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_ARC4_H
 #define POLARSSL_ARC4_H
 
+#include <string.h>
+
 /**
  * \brief          ARC4 context structure
  */
@@ -49,7 +51,7 @@
  * \param key      the secret key
  * \param keylen   length of the key
  */
-void arc4_setup( arc4_context *ctx, const unsigned char *key, int keylen );
+void arc4_setup( arc4_context *ctx, const unsigned char *key, unsigned int keylen );
 
 /**
  * \brief          ARC4 cipher function
@@ -61,7 +63,7 @@
  *
  * \return         0 if successful
  */
-int arc4_crypt( arc4_context *ctx, int length, const unsigned char *input,
+int arc4_crypt( arc4_context *ctx, size_t length, const unsigned char *input,
                 unsigned char *output );
 
 /*
diff --git a/include/polarssl/base64.h b/include/polarssl/base64.h
index 1c6498c..27ba685 100644
--- a/include/polarssl/base64.h
+++ b/include/polarssl/base64.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_BASE64_H
 #define POLARSSL_BASE64_H
 
+#include <string.h>
+
 #define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL               0x0010
 #define POLARSSL_ERR_BASE64_INVALID_CHARACTER              0x0012
 
@@ -49,8 +51,8 @@
  * \note           Call this function with *dlen = 0 to obtain the
  *                 required buffer size in *dlen
  */
-int base64_encode( unsigned char *dst, int *dlen,
-                   const unsigned char *src, int  slen );
+int base64_encode( unsigned char *dst, size_t *dlen,
+                   const unsigned char *src, size_t slen );
 
 /**
  * \brief          Decode a base64-formatted buffer
@@ -68,8 +70,8 @@
  * \note           Call this function with *dlen = 0 to obtain the
  *                 required buffer size in *dlen
  */
-int base64_decode( unsigned char *dst, int *dlen,
-                   const unsigned char *src, int  slen );
+int base64_decode( unsigned char *dst, size_t *dlen,
+                   const unsigned char *src, size_t slen );
 
 /**
  * \brief          Checkup routine
diff --git a/include/polarssl/bignum.h b/include/polarssl/bignum.h
index ebc1f8f..909df1d 100644
--- a/include/polarssl/bignum.h
+++ b/include/polarssl/bignum.h
@@ -28,6 +28,7 @@
 #define POLARSSL_BIGNUM_H
 
 #include <stdio.h>
+#include <string.h>
 
 #define POLARSSL_ERR_MPI_FILE_IO_ERROR                     0x0002
 #define POLARSSL_ERR_MPI_BAD_INPUT_DATA                    0x0004
@@ -43,13 +44,16 @@
  * Define the base integer type, architecture-wise
  */
 #if defined(POLARSSL_HAVE_INT8)
+typedef signed char t_s_int;
 typedef unsigned char  t_int;
 typedef unsigned short t_dbl;
 #else
 #if defined(POLARSSL_HAVE_INT16)
+typedef signed short t_s_int;
 typedef unsigned short t_int;
 typedef unsigned long  t_dbl;
 #else
+  typedef signed long t_s_int;
   typedef unsigned long t_int;
   #if defined(_MSC_VER) && defined(_M_IX86)
   typedef unsigned __int64 t_dbl;
@@ -73,7 +77,7 @@
 typedef struct
 {
     int s;              /*!<  integer sign      */
-    int n;              /*!<  total # of limbs  */
+    size_t n;           /*!<  total # of limbs  */
     t_int *p;           /*!<  pointer to limbs  */
 }
 mpi;
@@ -101,7 +105,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_grow( mpi *X, int nblimbs );
+int mpi_grow( mpi *X, size_t nblimbs );
 
 /**
  * \brief          Copy the contents of Y into X
@@ -131,28 +135,28 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_lset( mpi *X, int z );
+int mpi_lset( mpi *X, t_s_int z );
 
 /**
  * \brief          Return the number of least significant bits
  *
  * \param X        MPI to use
  */
-int mpi_lsb( const mpi *X );
+size_t mpi_lsb( const mpi *X );
 
 /**
  * \brief          Return the number of most significant bits
  *
  * \param X        MPI to use
  */
-int mpi_msb( const mpi *X );
+size_t mpi_msb( const mpi *X );
 
 /**
  * \brief          Return the total size in bytes
  *
  * \param X        MPI to use
  */
-int mpi_size( const mpi *X );
+size_t mpi_size( const mpi *X );
 
 /**
  * \brief          Import from an ASCII string
@@ -180,7 +184,7 @@
  * \note           Call this function with *slen = 0 to obtain the
  *                 minimum required buffer size in *slen.
  */
-int mpi_write_string( const mpi *X, int radix, char *s, int *slen );
+int mpi_write_string( const mpi *X, int radix, char *s, size_t *slen );
 
 /**
  * \brief          Read X from an opened file
@@ -217,7 +221,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_read_binary( mpi *X, const unsigned char *buf, int buflen );
+int mpi_read_binary( mpi *X, const unsigned char *buf, size_t buflen );
 
 /**
  * \brief          Export X into unsigned binary data, big endian
@@ -229,7 +233,7 @@
  * \return         0 if successful,
  *                 POLARSSL_ERR_MPI_BUFFER_TOO_SMALL if buf isn't large enough
  */
-int mpi_write_binary( const mpi *X, unsigned char *buf, int buflen );
+int mpi_write_binary( const mpi *X, unsigned char *buf, size_t buflen );
 
 /**
  * \brief          Left-shift: X <<= count
@@ -240,7 +244,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_shift_l( mpi *X, int count );
+int mpi_shift_l( mpi *X, size_t count );
 
 /**
  * \brief          Right-shift: X >>= count
@@ -251,7 +255,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_shift_r( mpi *X, int count );
+int mpi_shift_r( mpi *X, size_t count );
 
 /**
  * \brief          Compare unsigned values
@@ -287,7 +291,7 @@
  *                -1 if X is lesser  than z or
  *                 0 if X is equal to z
  */
-int mpi_cmp_int( const mpi *X, int z );
+int mpi_cmp_int( const mpi *X, t_s_int z );
 
 /**
  * \brief          Unsigned addition: X = |A| + |B|
@@ -347,7 +351,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_add_int( mpi *X, const mpi *A, int b );
+int mpi_add_int( mpi *X, const mpi *A, t_s_int b );
 
 /**
  * \brief          Signed substraction: X = A - b
@@ -359,7 +363,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_sub_int( mpi *X, const mpi *A, int b );
+int mpi_sub_int( mpi *X, const mpi *A, t_s_int b );
 
 /**
  * \brief          Baseline multiplication: X = A * B
@@ -385,7 +389,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_mul_int( mpi *X, const mpi *A, t_int b );
+int mpi_mul_int( mpi *X, const mpi *A, t_s_int b );
 
 /**
  * \brief          Division by mpi: A = Q * B + R
@@ -417,7 +421,7 @@
  *
  * \note           Either Q or R can be NULL.
  */
-int mpi_div_int( mpi *Q, mpi *R, const mpi *A, int b );
+int mpi_div_int( mpi *Q, mpi *R, const mpi *A, t_s_int b );
 
 /**
  * \brief          Modulo: R = A mod B
@@ -445,7 +449,7 @@
  *                 POLARSSL_ERR_MPI_DIVISION_BY_ZERO if b == 0,
  *                 POLARSSL_ERR_MPI_NEGATIVE_VALUE if b < 0
  */
-int mpi_mod_int( t_int *r, const mpi *A, int b );
+int mpi_mod_int( t_int *r, const mpi *A, t_s_int b );
 
 /**
  * \brief          Sliding-window exponentiation: X = A^E mod N
@@ -477,7 +481,7 @@
  * \return         0 if successful,
  *                 1 if memory allocation failed
  */
-int mpi_fill_random( mpi *X, int size, int (*f_rng)(void *), void *p_rng );
+int mpi_fill_random( mpi *X, size_t size, int (*f_rng)(void *), void *p_rng );
 
 /**
  * \brief          Greatest common divisor: G = gcd(A, B)
@@ -531,7 +535,7 @@
  *                 1 if memory allocation failed,
  *                 POLARSSL_ERR_MPI_BAD_INPUT_DATA if nbits is < 3
  */
-int mpi_gen_prime( mpi *X, int nbits, int dh_flag,
+int mpi_gen_prime( mpi *X, size_t nbits, int dh_flag,
                    int (*f_rng)(void *), void *p_rng );
 
 /**
diff --git a/include/polarssl/camellia.h b/include/polarssl/camellia.h
index cebd677..4884fdc 100644
--- a/include/polarssl/camellia.h
+++ b/include/polarssl/camellia.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_CAMELLIA_H
 #define POLARSSL_CAMELLIA_H
 
+#include <string.h>
+
 #ifdef _MSC_VER
 #include <basetsd.h>
 typedef UINT32 uint32_t;
@@ -63,7 +65,7 @@
  * 
  * \return         0 if successful, or POLARSSL_ERR_CAMELLIA_INVALID_KEY_LENGTH
  */
-int camellia_setkey_enc( camellia_context *ctx, const unsigned char *key, int keysize );
+int camellia_setkey_enc( camellia_context *ctx, const unsigned char *key, unsigned int keysize );
 
 /**
  * \brief          CAMELLIA key schedule (decryption)
@@ -74,7 +76,7 @@
  * 
  * \return         0 if successful, or POLARSSL_ERR_CAMELLIA_INVALID_KEY_LENGTH
  */
-int camellia_setkey_dec( camellia_context *ctx, const unsigned char *key, int keysize );
+int camellia_setkey_dec( camellia_context *ctx, const unsigned char *key, unsigned int keysize );
 
 /**
  * \brief          CAMELLIA-ECB block encryption/decryption
@@ -107,7 +109,7 @@
  */
 int camellia_crypt_cbc( camellia_context *ctx,
                     int mode,
-                    int length,
+                    size_t length,
                     unsigned char iv[16],
                     const unsigned char *input,
                     unsigned char *output );
@@ -127,7 +129,7 @@
  */
 int camellia_crypt_cfb128( camellia_context *ctx,
                        int mode,
-                       int length,
+                       size_t length,
                        int *iv_off,
                        unsigned char iv[16],
                        const unsigned char *input,
diff --git a/include/polarssl/cipher.h b/include/polarssl/cipher.h
index 5375559..67819da 100644
--- a/include/polarssl/cipher.h
+++ b/include/polarssl/cipher.h
@@ -96,26 +96,26 @@
     cipher_mode_t mode;
 
     /** Cipher key length, in bits (default length for variable sized ciphers) */
-    int key_length;
+    unsigned int key_length;
 
     /** Name of the cipher */
     const char * name;
 
     /** IV size, in bytes */
-    int iv_size;
+    unsigned int iv_size;
 
     /** block size, in bytes */
-    int block_size;
+    unsigned int block_size;
 
     /** Encrypt using CBC */
-    int (*cbc_func)( void *ctx, operation_t mode, int length, unsigned char *iv,
+    int (*cbc_func)( void *ctx, operation_t mode, size_t length, unsigned char *iv,
             const unsigned char *input, unsigned char *output );
 
     /** Set key for encryption purposes */
-    int (*setkey_enc_func)( void *ctx, const unsigned char *key, int key_length);
+    int (*setkey_enc_func)( void *ctx, const unsigned char *key, unsigned int key_length);
 
     /** Set key for decryption purposes */
-    int (*setkey_dec_func)( void *ctx, const unsigned char *key, int key_length);
+    int (*setkey_dec_func)( void *ctx, const unsigned char *key, unsigned int key_length);
 
     /** Allocate a new context */
     void * (*ctx_alloc_func)( void );
@@ -142,7 +142,7 @@
     unsigned char unprocessed_data[POLARSSL_MAX_IV_LENGTH];
 
     /** Number of bytes that still need processing */
-    int unprocessed_len;
+    size_t unprocessed_len;
 
     /** Current IV */
     unsigned char iv[POLARSSL_MAX_IV_LENGTH];
@@ -167,7 +167,7 @@
  * \brief               Returns the cipher information structure associated
  *                      with the given cipher name.
  *
- * \param cipher_name	Name of the cipher to search for.
+ * \param cipher_name   Name of the cipher to search for.
  *
  * \return              the cipher information structure associated with the
  *                      given cipher_name, or NULL if not found.
@@ -215,7 +215,7 @@
  * \return              size of the cipher's blocks, or 0 if ctx has not been
  *                      initialised.
  */
-static inline int cipher_get_block_size( const cipher_context_t *ctx )
+static inline unsigned int cipher_get_block_size( const cipher_context_t *ctx )
 {
     if( NULL == ctx || NULL == ctx->cipher_info )
         return 0;
@@ -332,8 +332,8 @@
  *
  * \returns             0 on success, 1 if parameter verification fails.
  */
-int cipher_update( cipher_context_t *ctx, const unsigned char *input, int ilen,
-        unsigned char *output, int *olen );
+int cipher_update( cipher_context_t *ctx, const unsigned char *input, size_t ilen,
+        unsigned char *output, size_t *olen );
 
 /**
  * \brief               Generic cipher finalisation function. If data still
@@ -347,7 +347,7 @@
  *
  * \returns             0 on success, 1 if parameter verification fails.
  */
-int cipher_finish( cipher_context_t *ctx, unsigned char *output, int *olen);
+int cipher_finish( cipher_context_t *ctx, unsigned char *output, size_t *olen);
 
 
 /**
diff --git a/include/polarssl/debug.h b/include/polarssl/debug.h
index c6f7406..e84f4b8 100644
--- a/include/polarssl/debug.h
+++ b/include/polarssl/debug.h
@@ -72,7 +72,7 @@
 
 void debug_print_buf( const ssl_context *ssl, int level,
                       const char *file, int line, const char *text,
-                      unsigned char *buf, int len );
+                      unsigned char *buf, size_t len );
 
 void debug_print_mpi( const ssl_context *ssl, int level,
                       const char *file, int line,
diff --git a/include/polarssl/des.h b/include/polarssl/des.h
index 0d3493c..f9e8e60 100644
--- a/include/polarssl/des.h
+++ b/include/polarssl/des.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_DES_H
 #define POLARSSL_DES_H
 
+#include <string.h>
+
 #define DES_ENCRYPT     1
 #define DES_DECRYPT     0
 
@@ -171,7 +173,7 @@
  */
 int des_crypt_cbc( des_context *ctx,
                     int mode,
-                    int length,
+                    size_t length,
                     unsigned char iv[8],
                     const unsigned char *input,
                     unsigned char *output );
@@ -203,7 +205,7 @@
  */
 int des3_crypt_cbc( des3_context *ctx,
                      int mode,
-                     int length,
+                     size_t length,
                      unsigned char iv[8],
                      const unsigned char *input,
                      unsigned char *output );
diff --git a/include/polarssl/dhm.h b/include/polarssl/dhm.h
index 4206b88..4a479d6 100644
--- a/include/polarssl/dhm.h
+++ b/include/polarssl/dhm.h
@@ -44,7 +44,7 @@
  */
 typedef struct
 {
-    int len;    /*!<  size(P) in chars  */
+    size_t len; /*!<  size(P) in chars  */
     mpi P;      /*!<  prime modulus     */
     mpi G;      /*!<  generator         */
     mpi X;      /*!<  secret value      */
@@ -89,7 +89,7 @@
  * \return         0 if successful, or an POLARSSL_ERR_DHM_XXX error code
  */
 int dhm_make_params( dhm_context *ctx, int x_size,
-                     unsigned char *output, int *olen,
+                     unsigned char *output, size_t *olen,
                      int (*f_rng)(void *), void *p_rng );
 
 /**
@@ -102,7 +102,7 @@
  * \return         0 if successful, or an POLARSSL_ERR_DHM_XXX error code
  */
 int dhm_read_public( dhm_context *ctx,
-                     const unsigned char *input, int ilen );
+                     const unsigned char *input, size_t ilen );
 
 /**
  * \brief          Create own private value X and export G^X
@@ -117,7 +117,7 @@
  * \return         0 if successful, or an POLARSSL_ERR_DHM_XXX error code
  */
 int dhm_make_public( dhm_context *ctx, int x_size,
-                     unsigned char *output, int olen,
+                     unsigned char *output, size_t olen,
                      int (*f_rng)(void *), void *p_rng );
 
 /**
@@ -130,7 +130,7 @@
  * \return         0 if successful, or an POLARSSL_ERR_DHM_XXX error code
  */
 int dhm_calc_secret( dhm_context *ctx,
-                     unsigned char *output, int *olen );
+                     unsigned char *output, size_t *olen );
 
 /*
  * \brief          Free the components of a DHM key
diff --git a/include/polarssl/md.h b/include/polarssl/md.h
index 4d4b835..9bda3ee 100644
--- a/include/polarssl/md.h
+++ b/include/polarssl/md.h
@@ -30,6 +30,8 @@
 #ifndef POLARSSL_MD_H
 #define POLARSSL_MD_H
 
+#include <string.h>
+
 #ifdef _MSC_VER
 #define inline _inline
 #endif
@@ -66,23 +68,23 @@
     void (*starts_func)( void *ctx );
 
     /** Digest update function */
-    void (*update_func)( void *ctx, const unsigned char *input, int ilen );
+    void (*update_func)( void *ctx, const unsigned char *input, size_t ilen );
 
     /** Digest finalisation function */
     void (*finish_func)( void *ctx, unsigned char *output );
 
     /** Generic digest function */
-    void (*digest_func)( const unsigned char *input, int ilen,
+    void (*digest_func)( const unsigned char *input, size_t ilen,
                             unsigned char *output );
 
     /** Generic file digest function */
     int (*file_func)( const char *path, unsigned char *output );
 
     /** HMAC Initialisation function */
-    void (*hmac_starts_func)( void *ctx, const unsigned char *key, int keylen );
+    void (*hmac_starts_func)( void *ctx, const unsigned char *key, size_t keylen );
 
     /** HMAC update function */
-    void (*hmac_update_func)( void *ctx, const unsigned char *input, int ilen );
+    void (*hmac_update_func)( void *ctx, const unsigned char *input, size_t ilen );
 
     /** HMAC finalisation function */
     void (*hmac_finish_func)( void *ctx, unsigned char *output);
@@ -91,8 +93,8 @@
     void (*hmac_reset_func)( void *ctx );
 
     /** Generic HMAC function */
-    void (*hmac_func)( const unsigned char *key, int keylen,
-                    const unsigned char *input, int ilen,
+    void (*hmac_func)( const unsigned char *key, size_t keylen,
+                    const unsigned char *input, size_t ilen,
                     unsigned char *output );
 
     /** Allocate a new context */
@@ -135,7 +137,7 @@
  * \brief           Returns the message digest information associated with the
  *                  given digest name.
  *
- * \param md_name	Name of the digest to search for.
+ * \param md_name   Name of the digest to search for.
  *
  * \return          The message digest information associated with md_name or
  *                  NULL if not found.
@@ -184,7 +186,7 @@
  *
  * \return          size of the message digest output.
  */
-static inline unsigned char md_get_size ( const md_info_t *md_info)
+static inline unsigned char md_get_size( const md_info_t *md_info )
 {
     return md_info->size;
 }
@@ -196,7 +198,7 @@
  *
  * \return          type of the message digest output.
  */
-static inline md_type_t md_get_type ( const md_info_t *md_info )
+static inline md_type_t md_get_type( const md_info_t *md_info )
 {
     return md_info->type;
 }
@@ -208,7 +210,7 @@
  *
  * \return          name of the message digest output.
  */
-static inline const char *md_get_name ( const md_info_t *md_info )
+static inline const char *md_get_name( const md_info_t *md_info )
 {
     return md_info->name;
 }
@@ -231,7 +233,7 @@
  *
  * \returns        0 on success, 1 if parameter verification fails.
  */
-int md_update( md_context_t *ctx, const unsigned char *input, int ilen );
+int md_update( md_context_t *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          Generic message digest final digest
@@ -253,7 +255,7 @@
  *
  * \returns        0 on success, 1 if parameter verification fails.
  */
-int md( const md_info_t *md_info, const unsigned char *input, int ilen,
+int md( const md_info_t *md_info, const unsigned char *input, size_t ilen,
         unsigned char *output );
 
 /**
@@ -277,7 +279,7 @@
  *
  * \returns        0 on success, 1 if parameter verification fails.
  */
-int md_hmac_starts( md_context_t *ctx, const unsigned char *key, int keylen );
+int md_hmac_starts( md_context_t *ctx, const unsigned char *key, size_t keylen );
 
 /**
  * \brief          Generic HMAC process buffer
@@ -288,7 +290,7 @@
  *
  * \returns        0 on success, 1 if parameter verification fails.
  */
-int md_hmac_update( md_context_t *ctx, const unsigned char *input, int ilen );
+int md_hmac_update( md_context_t *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          Generic HMAC final digest
@@ -321,8 +323,8 @@
  *
  * \returns        0 on success, 1 if parameter verification fails.
  */
-int md_hmac( const md_info_t *md_info, const unsigned char *key, int keylen,
-                const unsigned char *input, int ilen,
+int md_hmac( const md_info_t *md_info, const unsigned char *key, size_t keylen,
+                const unsigned char *input, size_t ilen,
                 unsigned char *output );
 
 #ifdef __cplusplus
diff --git a/include/polarssl/md2.h b/include/polarssl/md2.h
index bcda2e3..9a497f1 100644
--- a/include/polarssl/md2.h
+++ b/include/polarssl/md2.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_MD2_H
 #define POLARSSL_MD2_H
 
+#include <string.h>
+
 /**
  * \brief          MD2 context structure
  */
@@ -38,7 +40,7 @@
 
     unsigned char ipad[64];     /*!< HMAC: inner padding        */
     unsigned char opad[64];     /*!< HMAC: outer padding        */
-    int left;                   /*!< amount of data in buffer   */
+    size_t left;                /*!< amount of data in buffer   */
 }
 md2_context;
 
@@ -60,7 +62,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void md2_update( md2_context *ctx, const unsigned char *input, int ilen );
+void md2_update( md2_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD2 final digest
@@ -77,7 +79,7 @@
  * \param ilen     length of the input data
  * \param output   MD2 checksum result
  */
-void md2( const unsigned char *input, int ilen, unsigned char output[16] );
+void md2( const unsigned char *input, size_t ilen, unsigned char output[16] );
 
 /**
  * \brief          Output = MD2( file contents )
@@ -97,7 +99,7 @@
  * \param key      HMAC secret key
  * \param keylen   length of the HMAC key
  */
-void md2_hmac_starts( md2_context *ctx, const unsigned char *key, int keylen );
+void md2_hmac_starts( md2_context *ctx, const unsigned char *key, size_t keylen );
 
 /**
  * \brief          MD2 HMAC process buffer
@@ -106,7 +108,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void md2_hmac_update( md2_context *ctx, const unsigned char *input, int ilen );
+void md2_hmac_update( md2_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD2 HMAC final digest
@@ -132,8 +134,8 @@
  * \param ilen     length of the input data
  * \param output   HMAC-MD2 result
  */
-void md2_hmac( const unsigned char *key, int keylen,
-               const unsigned char *input, int ilen,
+void md2_hmac( const unsigned char *key, size_t keylen,
+               const unsigned char *input, size_t ilen,
                unsigned char output[16] );
 
 /**
diff --git a/include/polarssl/md4.h b/include/polarssl/md4.h
index c3c5d7e..5a796ae 100644
--- a/include/polarssl/md4.h
+++ b/include/polarssl/md4.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_MD4_H
 #define POLARSSL_MD4_H
 
+#include <string.h>
+
 /**
  * \brief          MD4 context structure
  */
@@ -59,7 +61,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void md4_update( md4_context *ctx, const unsigned char *input, int ilen );
+void md4_update( md4_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD4 final digest
@@ -76,7 +78,7 @@
  * \param ilen     length of the input data
  * \param output   MD4 checksum result
  */
-void md4( const unsigned char *input, int ilen, unsigned char output[16] );
+void md4( const unsigned char *input, size_t ilen, unsigned char output[16] );
 
 /**
  * \brief          Output = MD4( file contents )
@@ -96,7 +98,7 @@
  * \param key      HMAC secret key
  * \param keylen   length of the HMAC key
  */
-void md4_hmac_starts( md4_context *ctx, const unsigned char *key, int keylen );
+void md4_hmac_starts( md4_context *ctx, const unsigned char *key, size_t keylen );
 
 /**
  * \brief          MD4 HMAC process buffer
@@ -105,7 +107,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void md4_hmac_update( md4_context *ctx, const unsigned char *input, int ilen );
+void md4_hmac_update( md4_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD4 HMAC final digest
@@ -131,8 +133,8 @@
  * \param ilen     length of the input data
  * \param output   HMAC-MD4 result
  */
-void md4_hmac( const unsigned char *key, int keylen,
-               const unsigned char *input, int ilen,
+void md4_hmac( const unsigned char *key, size_t keylen,
+               const unsigned char *input, size_t ilen,
                unsigned char output[16] );
 
 /**
diff --git a/include/polarssl/md5.h b/include/polarssl/md5.h
index e728c38..cf0459d 100644
--- a/include/polarssl/md5.h
+++ b/include/polarssl/md5.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_MD5_H
 #define POLARSSL_MD5_H
 
+#include <string.h>
+
 /**
  * \brief          MD5 context structure
  */
@@ -59,7 +61,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void md5_update( md5_context *ctx, const unsigned char *input, int ilen );
+void md5_update( md5_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD5 final digest
@@ -76,7 +78,7 @@
  * \param ilen     length of the input data
  * \param output   MD5 checksum result
  */
-void md5( const unsigned char *input, int ilen, unsigned char output[16] );
+void md5( const unsigned char *input, size_t ilen, unsigned char output[16] );
 
 /**
  * \brief          Output = MD5( file contents )
@@ -97,7 +99,7 @@
  * \param keylen   length of the HMAC key
  */
 void md5_hmac_starts( md5_context *ctx,
-                      const unsigned char *key, int keylen );
+                      const unsigned char *key, size_t keylen );
 
 /**
  * \brief          MD5 HMAC process buffer
@@ -107,7 +109,7 @@
  * \param ilen     length of the input data
  */
 void md5_hmac_update( md5_context *ctx,
-                      const unsigned char *input, int ilen );
+                      const unsigned char *input, size_t ilen );
 
 /**
  * \brief          MD5 HMAC final digest
@@ -133,8 +135,8 @@
  * \param ilen     length of the input data
  * \param output   HMAC-MD5 result
  */
-void md5_hmac( const unsigned char *key, int keylen,
-               const unsigned char *input, int ilen,
+void md5_hmac( const unsigned char *key, size_t keylen,
+               const unsigned char *input, size_t ilen,
                unsigned char output[16] );
 
 /**
diff --git a/include/polarssl/net.h b/include/polarssl/net.h
index 188432e..3fa2161 100644
--- a/include/polarssl/net.h
+++ b/include/polarssl/net.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_NET_H
 #define POLARSSL_NET_H
 
+#include <string.h>
+
 #define POLARSSL_ERR_NET_UNKNOWN_HOST                      -0x0F00
 #define POLARSSL_ERR_NET_SOCKET_FAILED                     -0x0F10
 #define POLARSSL_ERR_NET_CONNECT_FAILED                    -0x0F20
@@ -124,7 +126,7 @@
  *                 or a non-zero error code; POLARSSL_ERR_NET_TRY_AGAIN
  *                 indicates read() is blocking.
  */
-int net_recv( void *ctx, unsigned char *buf, int len );
+int net_recv( void *ctx, unsigned char *buf, size_t len );
 
 /**
  * \brief          Write at most 'len' characters. If no error occurs,
@@ -138,7 +140,7 @@
  *                 or a non-zero error code; POLARSSL_ERR_NET_TRY_AGAIN
  *                 indicates write() is blocking.
  */
-int net_send( void *ctx, unsigned char *buf, int len );
+int net_send( void *ctx, unsigned char *buf, size_t len );
 
 /**
  * \brief          Gracefully shutdown the connection
diff --git a/include/polarssl/padlock.h b/include/polarssl/padlock.h
index 99ecfee..722c9b2 100644
--- a/include/polarssl/padlock.h
+++ b/include/polarssl/padlock.h
@@ -86,7 +86,7 @@
  */
 int padlock_xcryptcbc( aes_context *ctx,
                        int mode,
-                       int length,
+                       size_t length,
                        unsigned char iv[16],
                        const unsigned char *input,
                        unsigned char *output );
diff --git a/include/polarssl/pem.h b/include/polarssl/pem.h
index dfb2f1e..509ed11 100644
--- a/include/polarssl/pem.h
+++ b/include/polarssl/pem.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_PEM_H
 #define POLARSSL_PEM_H
 
+#include <string.h>
+
 /**
  * \name PEM Error codes
  * These error codes are returned in case of errors reading the
@@ -49,7 +51,7 @@
 typedef struct
 {
     unsigned char *buf;     /*!< buffer for decoded data             */
-    int buflen;             /*!< length of the buffer                */
+    size_t buflen;          /*!< length of the buffer                */
     unsigned char *info;    /*!< buffer for extra header information */
 }
 pem_context;
@@ -82,7 +84,7 @@
 int pem_read_buffer( pem_context *ctx, char *header, char *footer,
                      const unsigned char *data,
                      const unsigned char *pwd,
-                     int pwdlen, int *use_len );
+                     size_t pwdlen, size_t *use_len );
 
 /**
  * \brief       PEM context memory freeing
diff --git a/include/polarssl/pkcs11.h b/include/polarssl/pkcs11.h
index 5087e19..8e2a8ce 100644
--- a/include/polarssl/pkcs11.h
+++ b/include/polarssl/pkcs11.h
@@ -94,7 +94,7 @@
  *                 an error is thrown.
  */
 int pkcs11_decrypt( pkcs11_context *ctx,
-                       int mode, int *olen,
+                       int mode, size_t *olen,
                        const unsigned char *input,
                        unsigned char *output,
                        unsigned int output_max_len );
@@ -118,7 +118,7 @@
 int pkcs11_sign( pkcs11_context *ctx,
                     int mode,
                     int hash_id,
-                    int hashlen,
+                    unsigned int hashlen,
                     const unsigned char *hash,
                     unsigned char *sig );
 
diff --git a/include/polarssl/rsa.h b/include/polarssl/rsa.h
index 509e24d..cb2420a 100644
--- a/include/polarssl/rsa.h
+++ b/include/polarssl/rsa.h
@@ -49,11 +49,11 @@
 #define SIG_RSA_MD2     2
 #define SIG_RSA_MD4     3
 #define SIG_RSA_MD5     4
-#define SIG_RSA_SHA1	5
-#define SIG_RSA_SHA224	14
-#define SIG_RSA_SHA256	11
-#define	SIG_RSA_SHA384	12
-#define SIG_RSA_SHA512	13
+#define SIG_RSA_SHA1    5
+#define SIG_RSA_SHA224 14
+#define SIG_RSA_SHA256 11
+#define SIG_RSA_SHA384 12
+#define SIG_RSA_SHA512 13
 
 #define RSA_PUBLIC      0
 #define RSA_PRIVATE     1
@@ -64,28 +64,28 @@
 #define RSA_SIGN        1
 #define RSA_CRYPT       2
 
-#define ASN1_STR_CONSTRUCTED_SEQUENCE	"\x30"
-#define ASN1_STR_NULL			        "\x05"
-#define ASN1_STR_OID			        "\x06"
-#define ASN1_STR_OCTET_STRING		    "\x04"
+#define ASN1_STR_CONSTRUCTED_SEQUENCE   "\x30"
+#define ASN1_STR_NULL                   "\x05"
+#define ASN1_STR_OID                    "\x06"
+#define ASN1_STR_OCTET_STRING           "\x04"
 
-#define OID_DIGEST_ALG_MDX	        "\x2A\x86\x48\x86\xF7\x0D\x02\x00"
-#define OID_HASH_ALG_SHA1	        "\x2b\x0e\x03\x02\x1a"
-#define OID_HASH_ALG_SHA2X	        "\x60\x86\x48\x01\x65\x03\x04\x02\x00"
+#define OID_DIGEST_ALG_MDX              "\x2A\x86\x48\x86\xF7\x0D\x02\x00"
+#define OID_HASH_ALG_SHA1               "\x2b\x0e\x03\x02\x1a"
+#define OID_HASH_ALG_SHA2X              "\x60\x86\x48\x01\x65\x03\x04\x02\x00"
 
-#define OID_ISO_MEMBER_BODIES	    "\x2a"
-#define OID_ISO_IDENTIFIED_ORG	    "\x2b"
+#define OID_ISO_MEMBER_BODIES           "\x2a"
+#define OID_ISO_IDENTIFIED_ORG          "\x2b"
 
 /*
  * ISO Member bodies OID parts
  */
-#define OID_COUNTRY_US		        "\x86\x48"
-#define OID_RSA_DATA_SECURITY	    "\x86\xf7\x0d"
+#define OID_COUNTRY_US                  "\x86\x48"
+#define OID_RSA_DATA_SECURITY           "\x86\xf7\x0d"
 
 /*
  * ISO Identified organization OID parts
  */
-#define OID_OIW_SECSIG_SHA1	        "\x0e\x03\x02\x1a"
+#define OID_OIW_SECSIG_SHA1             "\x0e\x03\x02\x1a"
 
 /*
  * DigestInfo ::= SEQUENCE {
@@ -96,30 +96,30 @@
  *
  * Digest ::= OCTET STRING
  */
-#define ASN1_HASH_MDX					        \
-(							                    \
-    ASN1_STR_CONSTRUCTED_SEQUENCE "\x20"		\
-      ASN1_STR_CONSTRUCTED_SEQUENCE "\x0C"		\
-        ASN1_STR_OID "\x08"				        \
-	  OID_DIGEST_ALG_MDX				        \
-	ASN1_STR_NULL "\x00"				        \
-      ASN1_STR_OCTET_STRING "\x10"			    \
+#define ASN1_HASH_MDX                           \
+(                                               \
+    ASN1_STR_CONSTRUCTED_SEQUENCE "\x20"        \
+      ASN1_STR_CONSTRUCTED_SEQUENCE "\x0C"      \
+        ASN1_STR_OID "\x08"                     \
+      OID_DIGEST_ALG_MDX                        \
+    ASN1_STR_NULL "\x00"                        \
+      ASN1_STR_OCTET_STRING "\x10"              \
 )
 
-#define ASN1_HASH_SHA1					        \
-    ASN1_STR_CONSTRUCTED_SEQUENCE "\x21"		\
-      ASN1_STR_CONSTRUCTED_SEQUENCE "\x09"		\
-        ASN1_STR_OID "\x05"				        \
-	  OID_HASH_ALG_SHA1				            \
-        ASN1_STR_NULL "\x00"				    \
+#define ASN1_HASH_SHA1                          \
+    ASN1_STR_CONSTRUCTED_SEQUENCE "\x21"        \
+      ASN1_STR_CONSTRUCTED_SEQUENCE "\x09"      \
+        ASN1_STR_OID "\x05"                     \
+      OID_HASH_ALG_SHA1                         \
+        ASN1_STR_NULL "\x00"                    \
       ASN1_STR_OCTET_STRING "\x14"
 
-#define ASN1_HASH_SHA2X					        \
-    ASN1_STR_CONSTRUCTED_SEQUENCE "\x11"		\
-      ASN1_STR_CONSTRUCTED_SEQUENCE "\x0d"		\
-        ASN1_STR_OID "\x09"				        \
-	  OID_HASH_ALG_SHA2X				        \
-        ASN1_STR_NULL "\x00"				    \
+#define ASN1_HASH_SHA2X                         \
+    ASN1_STR_CONSTRUCTED_SEQUENCE "\x11"        \
+      ASN1_STR_CONSTRUCTED_SEQUENCE "\x0d"      \
+        ASN1_STR_OID "\x09"                     \
+      OID_HASH_ALG_SHA2X                        \
+        ASN1_STR_NULL "\x00"                    \
       ASN1_STR_OCTET_STRING "\x00"
 
 /**
@@ -128,7 +128,7 @@
 typedef struct
 {
     int ver;                    /*!<  always 0          */
-    int len;                    /*!<  size(N) in chars  */
+    size_t len;                 /*!<  size(N) in chars  */
 
     mpi N;                      /*!<  public modulus    */
     mpi E;                      /*!<  public exponent   */
@@ -188,7 +188,7 @@
 int rsa_gen_key( rsa_context *ctx,
                  int (*f_rng)(void *),
                  void *p_rng,
-                 int nbits, int exponent );
+                 unsigned int nbits, int exponent );
 
 /**
  * \brief          Check a public RSA key
@@ -263,7 +263,7 @@
 int rsa_pkcs1_encrypt( rsa_context *ctx,
                        int (*f_rng)(void *),
                        void *p_rng,
-                       int mode, int  ilen,
+                       int mode, size_t ilen,
                        const unsigned char *input,
                        unsigned char *output );
 
@@ -275,7 +275,7 @@
  * \param input    buffer holding the encrypted data
  * \param output   buffer that will hold the plaintext
  * \param olen     will contain the plaintext length
- * \param output_max_len	maximum length of the output buffer
+ * \param output_max_len    maximum length of the output buffer
  *
  * \return         0 if successful, or an POLARSSL_ERR_RSA_XXX error code
  *
@@ -284,10 +284,10 @@
  *                 an error is thrown.
  */
 int rsa_pkcs1_decrypt( rsa_context *ctx,
-                       int mode, int *olen,
+                       int mode, size_t *olen,
                        const unsigned char *input,
                        unsigned char *output,
-		               int output_max_len );
+                       size_t output_max_len );
 
 /**
  * \brief          Do a private RSA to sign a message digest
@@ -318,7 +318,7 @@
                     void *p_rng,
                     int mode,
                     int hash_id,
-                    int hashlen,
+                    unsigned int hashlen,
                     const unsigned char *hash,
                     unsigned char *sig );
 
@@ -347,7 +347,7 @@
 int rsa_pkcs1_verify( rsa_context *ctx,
                       int mode,
                       int hash_id,
-                      int hashlen,
+                      unsigned int hashlen,
                       const unsigned char *hash,
                       unsigned char *sig );
 
diff --git a/include/polarssl/sha1.h b/include/polarssl/sha1.h
index 1d5cc25..76b369a 100644
--- a/include/polarssl/sha1.h
+++ b/include/polarssl/sha1.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_SHA1_H
 #define POLARSSL_SHA1_H
 
+#include <string.h>
+
 /**
  * \brief          SHA-1 context structure
  */
@@ -59,7 +61,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha1_update( sha1_context *ctx, const unsigned char *input, int ilen );
+void sha1_update( sha1_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-1 final digest
@@ -76,7 +78,7 @@
  * \param ilen     length of the input data
  * \param output   SHA-1 checksum result
  */
-void sha1( const unsigned char *input, int ilen, unsigned char output[20] );
+void sha1( const unsigned char *input, size_t ilen, unsigned char output[20] );
 
 /**
  * \brief          Output = SHA-1( file contents )
@@ -96,7 +98,7 @@
  * \param key      HMAC secret key
  * \param keylen   length of the HMAC key
  */
-void sha1_hmac_starts( sha1_context *ctx, const unsigned char *key, int keylen );
+void sha1_hmac_starts( sha1_context *ctx, const unsigned char *key, size_t keylen );
 
 /**
  * \brief          SHA-1 HMAC process buffer
@@ -105,7 +107,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha1_hmac_update( sha1_context *ctx, const unsigned char *input, int ilen );
+void sha1_hmac_update( sha1_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-1 HMAC final digest
@@ -131,8 +133,8 @@
  * \param ilen     length of the input data
  * \param output   HMAC-SHA-1 result
  */
-void sha1_hmac( const unsigned char *key, int keylen,
-                const unsigned char *input, int ilen,
+void sha1_hmac( const unsigned char *key, size_t keylen,
+                const unsigned char *input, size_t ilen,
                 unsigned char output[20] );
 
 /**
diff --git a/include/polarssl/sha2.h b/include/polarssl/sha2.h
index 5e2d907..c963ca1 100644
--- a/include/polarssl/sha2.h
+++ b/include/polarssl/sha2.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_SHA2_H
 #define POLARSSL_SHA2_H
 
+#include <string.h>
+
 /**
  * \brief          SHA-256 context structure
  */
@@ -61,7 +63,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha2_update( sha2_context *ctx, const unsigned char *input, int ilen );
+void sha2_update( sha2_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-256 final digest
@@ -79,7 +81,7 @@
  * \param output   SHA-224/256 checksum result
  * \param is224    0 = use SHA256, 1 = use SHA224
  */
-void sha2( const unsigned char *input, int ilen,
+void sha2( const unsigned char *input, size_t ilen,
            unsigned char output[32], int is224 );
 
 /**
@@ -102,7 +104,7 @@
  * \param keylen   length of the HMAC key
  * \param is224    0 = use SHA256, 1 = use SHA224
  */
-void sha2_hmac_starts( sha2_context *ctx, const unsigned char *key, int keylen,
+void sha2_hmac_starts( sha2_context *ctx, const unsigned char *key, size_t keylen,
                        int is224 );
 
 /**
@@ -112,7 +114,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha2_hmac_update( sha2_context *ctx, const unsigned char *input, int ilen );
+void sha2_hmac_update( sha2_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-256 HMAC final digest
@@ -139,8 +141,8 @@
  * \param output   HMAC-SHA-224/256 result
  * \param is224    0 = use SHA256, 1 = use SHA224
  */
-void sha2_hmac( const unsigned char *key, int keylen,
-                const unsigned char *input, int ilen,
+void sha2_hmac( const unsigned char *key, size_t keylen,
+                const unsigned char *input, size_t ilen,
                 unsigned char output[32], int is224 );
 
 /**
diff --git a/include/polarssl/sha4.h b/include/polarssl/sha4.h
index 5f980b9..81a69cd 100644
--- a/include/polarssl/sha4.h
+++ b/include/polarssl/sha4.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_SHA4_H
 #define POLARSSL_SHA4_H
 
+#include <string.h>
+
 #if defined(_MSC_VER) || defined(__WATCOMC__)
   #define UL64(x) x##ui64
   #define int64 __int64
@@ -69,7 +71,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha4_update( sha4_context *ctx, const unsigned char *input, int ilen );
+void sha4_update( sha4_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-512 final digest
@@ -87,7 +89,7 @@
  * \param output   SHA-384/512 checksum result
  * \param is384    0 = use SHA512, 1 = use SHA384
  */
-void sha4( const unsigned char *input, int ilen,
+void sha4( const unsigned char *input, size_t ilen,
            unsigned char output[64], int is384 );
 
 /**
@@ -110,7 +112,7 @@
  * \param key      HMAC secret key
  * \param keylen   length of the HMAC key
  */
-void sha4_hmac_starts( sha4_context *ctx, const unsigned char *key, int keylen,
+void sha4_hmac_starts( sha4_context *ctx, const unsigned char *key, size_t keylen,
                        int is384 );
 
 /**
@@ -120,7 +122,7 @@
  * \param input    buffer holding the  data
  * \param ilen     length of the input data
  */
-void sha4_hmac_update( sha4_context *ctx, const unsigned char *input, int ilen );
+void sha4_hmac_update( sha4_context *ctx, const unsigned char *input, size_t ilen );
 
 /**
  * \brief          SHA-512 HMAC final digest
@@ -147,8 +149,8 @@
  * \param output   HMAC-SHA-384/512 result
  * \param is384    0 = use SHA512, 1 = use SHA384
  */
-void sha4_hmac( const unsigned char *key, int keylen,
-                const unsigned char *input, int ilen,
+void sha4_hmac( const unsigned char *key, size_t keylen,
+                const unsigned char *input, size_t ilen,
                 unsigned char output[64], int is384 );
 
 /**
diff --git a/include/polarssl/ssl.h b/include/polarssl/ssl.h
index 772bb55..15b595f 100644
--- a/include/polarssl/ssl.h
+++ b/include/polarssl/ssl.h
@@ -204,7 +204,7 @@
 {
     time_t start;               /*!< starting time      */
     int ciphersuite;            /*!< chosen ciphersuite */
-    int length;                 /*!< session id length  */
+    size_t length;              /*!< session id length  */
     unsigned char id[32];       /*!< session identifier */
     unsigned char master[48];   /*!< the master secret  */
     ssl_session *next;          /*!< next session entry */
@@ -228,8 +228,8 @@
      */
     int  (*f_rng)(void *);
     void (*f_dbg)(void *, int, const char *);
-    int (*f_recv)(void *, unsigned char *, int);
-    int (*f_send)(void *, unsigned char *, int);
+    int (*f_recv)(void *, unsigned char *, size_t);
+    int (*f_send)(void *, unsigned char *, size_t);
     int (*f_vrfy)(void *, x509_cert *, int, int);
 
     void *p_rng;                /*!< context for the RNG function     */
@@ -256,10 +256,10 @@
     unsigned char *in_offt;     /*!< read offset in application data  */
 
     int in_msgtype;             /*!< record header: message type      */
-    int in_msglen;              /*!< record header: message length    */
-    int in_left;                /*!< amount of data read so far       */
+    size_t in_msglen;           /*!< record header: message length    */
+    size_t in_left;             /*!< amount of data read so far       */
 
-    int in_hslen;               /*!< current handshake message length */
+    size_t in_hslen;            /*!< current handshake message length */
     int nb_zero;                /*!< # of 0-length encrypted messages */
 
     /*
@@ -270,8 +270,8 @@
     unsigned char *out_msg;     /*!< the message contents (out_hdr+5) */
 
     int out_msgtype;            /*!< record header: message type      */
-    int out_msglen;             /*!< record header: message length    */
-    int out_left;               /*!< amount of data not yet written   */
+    size_t out_msglen;          /*!< record header: message length    */
+    size_t out_left;            /*!< amount of data not yet written   */
 
     /*
      * PKI layer
@@ -300,11 +300,11 @@
 
     int do_crypt;                       /*!<  en(de)cryption flag     */
     int *ciphersuites;                  /*!<  allowed ciphersuites    */
-    int pmslen;                         /*!<  premaster length        */
-    int keylen;                         /*!<  symmetric key length    */
-    int minlen;                         /*!<  min. ciphertext length  */
-    int ivlen;                          /*!<  IV length               */
-    int maclen;                         /*!<  MAC length              */
+    size_t pmslen;                      /*!<  premaster length        */
+    unsigned int keylen;                /*!<  symmetric key length    */
+    size_t minlen;                      /*!<  min. ciphertext length  */
+    size_t ivlen;                       /*!<  IV length               */
+    size_t maclen;                      /*!<  MAC length              */
 
     unsigned char randbytes[64];        /*!<  random bytes            */
     unsigned char premaster[256];       /*!<  premaster secret        */
@@ -322,7 +322,7 @@
      * TLS extensions
      */
     unsigned char *hostname;
-    unsigned long  hostname_len;
+    size_t         hostname_len;
 };
 
 #ifdef __cplusplus
@@ -447,8 +447,8 @@
  * \param p_send   write parameter
  */
 void ssl_set_bio( ssl_context *ssl,
-        int (*f_recv)(void *, unsigned char *, int), void *p_recv,
-        int (*f_send)(void *, unsigned char *, int), void *p_send );
+        int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
+        int (*f_send)(void *, unsigned char *, size_t), void *p_send );
 
 /**
  * \brief          Set the session callbacks (server-side only)
@@ -556,7 +556,7 @@
  *
  * \return         how many bytes are available in the read buffer
  */
-int ssl_get_bytes_avail( const ssl_context *ssl );
+size_t ssl_get_bytes_avail( const ssl_context *ssl );
 
 /**
  * \brief          Return the result of the certificate verification
@@ -609,7 +609,7 @@
  * \return         This function returns the number of bytes read,
  *                 or a negative error code.
  */
-int ssl_read( ssl_context *ssl, unsigned char *buf, int len );
+int ssl_read( ssl_context *ssl, unsigned char *buf, size_t len );
 
 /**
  * \brief          Write exactly 'len' application data bytes
@@ -625,7 +625,7 @@
  *                 it must be called later with the *same* arguments,
  *                 until it returns a positive value.
  */
-int ssl_write( ssl_context *ssl, const unsigned char *buf, int len );
+int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len );
 
 /**
  * \brief          Notify the peer that the connection is being closed
@@ -651,7 +651,7 @@
 void ssl_calc_verify( ssl_context *ssl, unsigned char hash[36] );
 
 int ssl_read_record( ssl_context *ssl );
-int ssl_fetch_input( ssl_context *ssl, int nb_want );
+int ssl_fetch_input( ssl_context *ssl, size_t nb_want );
 
 int ssl_write_record( ssl_context *ssl );
 int ssl_flush_output( ssl_context *ssl );
diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index e6d0c34..731c186 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -284,7 +284,7 @@
 typedef struct _x509_buf
 {
     int tag;                /**< ASN1 type, e.g. ASN1_UTF8_STRING. */
-    int len;                /**< ASN1 length, e.g. in octets. */
+    size_t len;             /**< ASN1 length, e.g. in octets. */
     unsigned char *p;       /**< ASN1 data, e.g. in ASCII. */
 }
 x509_buf;
@@ -294,7 +294,7 @@
  */
 typedef struct _x509_bitstring
 {
-    int len;                    /**< ASN1 length, e.g. in octets. */
+    size_t len;                 /**< ASN1 length, e.g. in octets. */
     unsigned char unused_bits;  /**< Number of unused bits at the end of the string */
     unsigned char *p;           /**< Raw ASN1 data for the bit string */
 }
@@ -483,7 +483,7 @@
  *
  * \return         0 if successful, or a specific X509 or PEM error code
  */
-int x509parse_crt( x509_cert *chain, const unsigned char *buf, int buflen );
+int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen );
 
 /** \ingroup x509_module */
 /**
@@ -508,7 +508,7 @@
  *
  * \return         0 if successful, or a specific X509 or PEM error code
  */
-int x509parse_crl( x509_crl *chain, const unsigned char *buf, int buflen );
+int x509parse_crl( x509_crl *chain, const unsigned char *buf, size_t buflen );
 
 /** \ingroup x509_module */
 /**
@@ -535,8 +535,8 @@
  * \return         0 if successful, or a specific X509 or PEM error code
  */
 int x509parse_key( rsa_context *rsa,
-                   const unsigned char *key, int keylen,
-                   const unsigned char *pwd, int pwdlen );
+                   const unsigned char *key, size_t keylen,
+                   const unsigned char *pwd, size_t pwdlen );
 
 /** \ingroup x509_module */
 /**
@@ -562,7 +562,7 @@
  * \return         0 if successful, or a specific X509 or PEM error code
  */
 int x509parse_public_key( rsa_context *rsa,
-                   const unsigned char *key, int keylen );
+                   const unsigned char *key, size_t keylen );
 
 /** \ingroup x509_module */
 /**
@@ -585,7 +585,7 @@
  *
  * \return         0 if successful, or a specific X509 or PEM error code
  */
-int x509parse_dhm( dhm_context *dhm, const unsigned char *dhmin, int dhminlen );
+int x509parse_dhm( dhm_context *dhm, const unsigned char *dhmin, size_t dhminlen );
 
 /** \ingroup x509_module */
 /**
diff --git a/include/polarssl/xtea.h b/include/polarssl/xtea.h
index feb1237..8f41d5d 100644
--- a/include/polarssl/xtea.h
+++ b/include/polarssl/xtea.h
@@ -27,6 +27,8 @@
 #ifndef POLARSSL_XTEA_H
 #define POLARSSL_XTEA_H
 
+#include <string.h>
+
 #ifdef _MSC_VER
 #include <basetsd.h>
 typedef UINT32 uint32_t;
@@ -71,9 +73,9 @@
  * \return         0 if successful
  */
 int xtea_crypt_ecb( xtea_context *ctx,
-		 int mode,
-		 unsigned char input[8],
-		 unsigned char output[8] );
+                    int mode,
+                    unsigned char input[8],
+                    unsigned char output[8] );
 
 /**
  * \brief          XTEA CBC cipher function
@@ -90,7 +92,7 @@
  */
 int xtea_crypt_cbc( xtea_context *ctx,
                     int mode,
-                    int length,
+                    size_t length,
                     unsigned char iv[8],
                     unsigned char *input,
                     unsigned char *output);