diff --git a/include/polarssl/pkcs11.h b/include/polarssl/pkcs11.h
index ddfae30176..003d3f52df 100644
--- a/include/polarssl/pkcs11.h
+++ b/include/polarssl/pkcs11.h
@@ -104,7 +104,7 @@ int pkcs11_decrypt( pkcs11_context *ctx,
                        int mode, size_t *olen,
                        const unsigned char *input,
                        unsigned char *output,
-                       unsigned int output_max_len );
+                       size_t output_max_len );
 
 /**
  * \brief          Do a private RSA to sign a message digest
@@ -134,7 +134,7 @@ int pkcs11_sign( pkcs11_context *ctx,
  */
 static inline int ssl_pkcs11_decrypt( void *ctx, int mode, size_t *olen,
                         const unsigned char *input, unsigned char *output,
-                        unsigned int output_max_len )
+                        size_t output_max_len )
 {
     return pkcs11_decrypt( (pkcs11_context *) ctx, mode, olen, input, output,
                            output_max_len );
diff --git a/library/pkcs11.c b/library/pkcs11.c
index b71415a41d..b68d6881db 100644
--- a/library/pkcs11.c
+++ b/library/pkcs11.c
@@ -115,7 +115,7 @@ int pkcs11_decrypt( pkcs11_context *ctx,
                        int mode, size_t *olen,
                        const unsigned char *input,
                        unsigned char *output,
-                       unsigned int output_max_len )
+                       size_t output_max_len )
 {
     size_t input_len, output_len;