chore(crypto): replace `int` by `size_t` for nonnegative parameters

diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip32.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip32.h
index 80fd0b9c..2347e5b7 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip32.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip32.h
@@ -230,9 +230,9 @@ STATIC mp_obj_t mod_trezorcrypto_HDNode_serialize_public(mp_obj_t self,
 
   vstr_t xpub = {0};
   vstr_init_len(&xpub, XPUB_MAXLEN);
-  int written = hdnode_serialize_public(&o->hdnode, o->fingerprint, ver,
-                                        xpub.buf, xpub.alloc);
-  if (written <= 0) {
+  size_t written = hdnode_serialize_public(&o->hdnode, o->fingerprint, ver,
+                                           xpub.buf, xpub.alloc);
+  if (written == 0) {
     vstr_clear(&xpub);
     mp_raise_ValueError(MP_ERROR_TEXT("Failed to serialize"));
   }
diff --git a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip39.h b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip39.h
index 9d21caf8..a7dc9c0d 100644
--- a/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip39.h
+++ b/core/embed/upymod/modtrezorcrypto/modtrezorcrypto-bip39.h
@@ -101,8 +101,8 @@ STATIC mp_obj_t mod_trezorcrypto_bip39_mnemonic_to_bits(mp_obj_t mnemonic) {
   mp_get_buffer_raise(mnemonic, &text, MP_BUFFER_READ);
 
   uint8_t bits[33] = {0};
-  int binary_mnemonics_len = mnemonic_to_bits((const char *)text.buf, bits);
-  if (binary_mnemonics_len <= 0) {
+  size_t binary_mnemonics_len = mnemonic_to_bits((const char *)text.buf, bits);
+  if (binary_mnemonics_len == 0) {
     mp_raise_ValueError(MP_ERROR_TEXT("Invalid mnemonic"));
   }
   return mp_obj_new_bytes(bits, (binary_mnemonics_len + 7) / 8);
diff --git a/crypto/address.c b/crypto/address.c
index 598a49f7..2ae52193 100644
--- a/crypto/address.c
+++ b/crypto/address.c
@@ -73,8 +73,8 @@ void ethereum_address_checksum(const uint8_t *addr, char *address, bool rskip60,
   keccak_256_Init(&ctx);
   if (rskip60) {
     char prefix[16] = {0};
-    int prefix_size = bn_format_uint64(chain_id, NULL, "0x", 0, 0, false, 0,
-                                       prefix, sizeof(prefix));
+    size_t prefix_size = bn_format_uint64(chain_id, NULL, "0x", 0, 0, false, 0,
+                                          prefix, sizeof(prefix));
     keccak_Update(&ctx, (const uint8_t *)prefix, prefix_size);
   }
   keccak_Update(&ctx, (const uint8_t *)(address + 2), 40);
diff --git a/crypto/base58.c b/crypto/base58.c
index 2b7b36fd..204f1475 100644
--- a/crypto/base58.c
+++ b/crypto/base58.c
@@ -185,9 +185,9 @@ bool b58enc(char *b58, size_t *b58sz, const void *data, size_t binsz) {
   return true;
 }
 
-int base58_encode_check(const uint8_t *data, int datalen,
-                        HasherType hasher_type, char *str, int strsize) {
-  if (datalen < 0 || datalen > 128) {
+size_t base58_encode_check(const uint8_t *data, size_t datalen,
+                           HasherType hasher_type, char *str, size_t strsize) {
+  if (datalen > 128) {
     return 0;
   }
   uint8_t buf[datalen + 32];
@@ -201,9 +201,9 @@ int base58_encode_check(const uint8_t *data, int datalen,
   return success ? res : 0;
 }
 
-int base58_decode_check(const char *str, HasherType hasher_type, uint8_t *data,
-                        int datalen) {
-  if (datalen < 0 || datalen > 128) {
+size_t base58_decode_check(const char *str, HasherType hasher_type,
+                           uint8_t *data, size_t datalen) {
+  if (datalen > 128) {
     return 0;
   }
   uint8_t d[datalen + 4];
diff --git a/crypto/base58.h b/crypto/base58.h
index 9b7762f8..2ae08e15 100644
--- a/crypto/base58.h
+++ b/crypto/base58.h
@@ -25,6 +25,7 @@
 #define __BASE58_H__
 
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdint.h>
 #include "hasher.h"
 #include "options.h"
@@ -32,10 +33,10 @@
 extern const char b58digits_ordered[];
 extern const int8_t b58digits_map[];
 
-int base58_encode_check(const uint8_t *data, int len, HasherType hasher_type,
-                        char *str, int strsize);
-int base58_decode_check(const char *str, HasherType hasher_type, uint8_t *data,
-                        int datalen);
+size_t base58_encode_check(const uint8_t *data, size_t datalen,
+                           HasherType hasher_type, char *str, size_t strsize);
+size_t base58_decode_check(const char *str, HasherType hasher_type,
+                           uint8_t *data, size_t datalen);
 
 // Private
 bool b58tobin(void *bin, size_t *binszp, const char *b58);
diff --git a/crypto/bignum.c b/crypto/bignum.c
index 5c64c8fc..d3ce523a 100644
--- a/crypto/bignum.c
+++ b/crypto/bignum.c
@@ -1869,7 +1869,8 @@ size_t bn_format(const bignum256 *amount, const char *prefix, const char *suffix
     BN_FORMAT_ADD_OUTPUT_CHAR(prefix[i])
 
   // Move formatted amount to the start of output
-  int length = output - position + output_length;
+  assert(output <= position && position < output + output_length);
+  size_t length = (size_t)(output + output_length - position);
   memmove(output, position, length);
   return length - 1;
 }
diff --git a/crypto/bip32.c b/crypto/bip32.c
index f5ccfcde..dd05f405 100644
--- a/crypto/bip32.c
+++ b/crypto/bip32.c
@@ -142,7 +142,7 @@ int hdnode_from_xprv(uint32_t depth, uint32_t child_num,
   return 1;
 }
 
-int hdnode_from_seed(const uint8_t *seed, int seed_len, const char *curve,
+int hdnode_from_seed(const uint8_t *seed, size_t seed_len, const char *curve,
                      HDNode *out) {
   LOCAL_CONFIDENTIAL uint8_t I[32 + 32];
   memzero(out, sizeof(HDNode));
@@ -339,7 +339,7 @@ int hdnode_public_ckd(HDNode *inout, uint32_t i) {
 #if USE_BIP32_CACHE
 static bool private_ckd_cache_root_set = false;
 static CONFIDENTIAL HDNode private_ckd_cache_root;
-static int private_ckd_cache_index = 0;
+static size_t private_ckd_cache_index = 0;
 
 static CONFIDENTIAL struct {
   bool set;
@@ -436,7 +436,7 @@ int hdnode_get_address_raw(HDNode *node, uint32_t version, uint8_t *addr_raw) {
 }
 
 int hdnode_get_address(HDNode *node, uint32_t version, char *addr,
-                       int addrsize) {
+                       size_t addrsize) {
   if (hdnode_fill_public_key(node) != 0) {
     return 1;
   }
@@ -663,7 +663,7 @@ int hdnode_sign_digest(HDNode *node, const uint8_t *digest, uint8_t *sig,
 }
 
 int hdnode_get_shared_key(const HDNode *node, const uint8_t *peer_public_key,
-                          uint8_t *session_key, int *result_size) {
+                          uint8_t *session_key, size_t *result_size) {
   // Use elliptic curve Diffie-Helman to compute shared session key
   if (node->curve->params) {
     if (ecdh_multiply(node->curve->params, node->private_key, peer_public_key,
@@ -689,9 +689,9 @@ int hdnode_get_shared_key(const HDNode *node, const uint8_t *peer_public_key,
   }
 }
 
-static int hdnode_serialize(const HDNode *node, uint32_t fingerprint,
-                            uint32_t version, bool use_private, char *str,
-                            int strsize) {
+static size_t hdnode_serialize(const HDNode *node, uint32_t fingerprint,
+                               uint32_t version, bool use_private, char *str,
+                               size_t strsize) {
   uint8_t node_data[78] = {0};
   write_be(node_data, version);
   node_data[4] = node->depth;
@@ -704,19 +704,19 @@ static int hdnode_serialize(const HDNode *node, uint32_t fingerprint,
   } else {
     memcpy(node_data + 45, node->public_key, 33);
   }
-  int ret = base58_encode_check(node_data, sizeof(node_data),
-                                node->curve->hasher_base58, str, strsize);
+  size_t ret = base58_encode_check(node_data, sizeof(node_data),
+                                   node->curve->hasher_base58, str, strsize);
   memzero(node_data, sizeof(node_data));
   return ret;
 }
 
-int hdnode_serialize_public(const HDNode *node, uint32_t fingerprint,
-                            uint32_t version, char *str, int strsize) {
+size_t hdnode_serialize_public(const HDNode *node, uint32_t fingerprint,
+                               uint32_t version, char *str, size_t strsize) {
   return hdnode_serialize(node, fingerprint, version, false, str, strsize);
 }
 
-int hdnode_serialize_private(const HDNode *node, uint32_t fingerprint,
-                             uint32_t version, char *str, int strsize) {
+size_t hdnode_serialize_private(const HDNode *node, uint32_t fingerprint,
+                                uint32_t version, char *str, size_t strsize) {
   return hdnode_serialize(node, fingerprint, version, true, str, strsize);
 }
 
diff --git a/crypto/bip32.h b/crypto/bip32.h
index b02beb65..ccaf9c30 100644
--- a/crypto/bip32.h
+++ b/crypto/bip32.h
@@ -25,6 +25,7 @@
 #define __BIP32_H__
 
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include "ecdsa.h"
@@ -68,7 +69,7 @@ int hdnode_from_xprv(uint32_t depth, uint32_t child_num,
                      const uint8_t *chain_code, const uint8_t *private_key,
                      const char *curve, HDNode *out);
 
-int hdnode_from_seed(const uint8_t *seed, int seed_len, const char *curve,
+int hdnode_from_seed(const uint8_t *seed, size_t seed_len, const char *curve,
                      HDNode *out);
 
 #define hdnode_private_ckd_prime(X, I) \
@@ -113,13 +114,13 @@ int hdnode_sign_digest(HDNode *node, const uint8_t *digest, uint8_t *sig,
                        int (*is_canonical)(uint8_t by, uint8_t sig[64]));
 
 int hdnode_get_shared_key(const HDNode *node, const uint8_t *peer_public_key,
-                          uint8_t *session_key, int *result_size);
+                          uint8_t *session_key, size_t *result_size);
 
-int hdnode_serialize_public(const HDNode *node, uint32_t fingerprint,
-                            uint32_t version, char *str, int strsize);
+size_t hdnode_serialize_public(const HDNode *node, uint32_t fingerprint,
+                               uint32_t version, char *str, size_t strsize);
 
-int hdnode_serialize_private(const HDNode *node, uint32_t fingerprint,
-                             uint32_t version, char *str, int strsize);
+size_t hdnode_serialize_private(const HDNode *node, uint32_t fingerprint,
+                                uint32_t version, char *str, size_t strsize);
 
 int hdnode_deserialize_public(const char *str, uint32_t version,
                               const char *curve, HDNode *node,
@@ -131,7 +132,7 @@ int hdnode_deserialize_private(const char *str, uint32_t version,
 
 int hdnode_get_address_raw(HDNode *node, uint32_t version, uint8_t *addr_raw);
 int hdnode_get_address(HDNode *node, uint32_t version, char *addr,
-                       int addrsize);
+                       size_t addrsize);
 
 const curve_info *get_curve_by_name(const char *curve_name);
 
diff --git a/crypto/bip39.c b/crypto/bip39.c
index dcbf6446..b004c181 100644
--- a/crypto/bip39.c
+++ b/crypto/bip39.c
@@ -53,7 +53,7 @@ void bip39_cache_clear(void) {
 
 static CONFIDENTIAL char mnemo[24 * 10];
 
-const char *mnemonic_from_data(const uint8_t *data, int len) {
+const char *mnemonic_from_data(const uint8_t *data, size_t len) {
   if (len % 4 || len < 16 || len > 32) {
     return 0;
   }
@@ -66,9 +66,10 @@ const char *mnemonic_from_data(const uint8_t *data, int len) {
   // data
   memcpy(bits, data, len);
 
-  int mlen = len * 3 / 4;
+  size_t mlen = len * 3 / 4;
 
-  int i = 0, j = 0, idx = 0;
+  size_t i = 0, j = 0;
+  int idx = 0;
   char *p = mnemo;
   for (i = 0; i < mlen; i++) {
     idx = 0;
@@ -88,7 +89,7 @@ const char *mnemonic_from_data(const uint8_t *data, int len) {
 
 void mnemonic_clear(void) { memzero(mnemo, sizeof(mnemo)); }
 
-int mnemonic_to_bits(const char *mnemonic_orig, uint8_t *bits) {
+size_t mnemonic_to_bits(const char *mnemonic_orig, uint8_t *bits) {
   if (!mnemonic_orig) {
     return 0;
   }
@@ -99,7 +100,7 @@ int mnemonic_to_bits(const char *mnemonic_orig, uint8_t *bits) {
   // robust and easier to analyze.
   char mnemonic[BIP39_MAX_MNEMONIC_LEN + BIP39_MAX_WORD_LEN + 1] = {0};
   uint8_t result[32 + 1] = {0};
-  int result_bits = 0;
+  size_t result_bits = 0;
 
   size_t mnemonic_len = strlen(mnemonic_orig);
   if (mnemonic_len > BIP39_MAX_MNEMONIC_LEN) {
@@ -170,13 +171,13 @@ cleanup:
 
 int mnemonic_check(const char *mnemonic) {
   uint8_t bits[32 + 1] = {0};
-  int mnemonic_bits_len = mnemonic_to_bits(mnemonic, bits);
+  size_t mnemonic_bits_len = mnemonic_to_bits(mnemonic, bits);
   if (mnemonic_bits_len != (12 * BIP39_BITS_PER_WORD) &&
       mnemonic_bits_len != (18 * BIP39_BITS_PER_WORD) &&
       mnemonic_bits_len != (24 * BIP39_BITS_PER_WORD)) {
     return 0;
   }
-  int words = mnemonic_bits_len / BIP39_BITS_PER_WORD;
+  size_t words = mnemonic_bits_len / BIP39_BITS_PER_WORD;
 
   uint8_t checksum = bits[words * 4 / 3];
   sha256_Raw(bits, words * 4 / 3, bits);
@@ -195,8 +196,8 @@ void mnemonic_to_seed(const char *mnemonic, const char *passphrase,
                       uint8_t seed[512 / 8],
                       void (*progress_callback)(uint32_t current,
                                                 uint32_t total)) {
-  int mnemoniclen = strlen(mnemonic);
-  int passphraselen = strnlen(passphrase, 256);
+  size_t mnemoniclen = strlen(mnemonic);
+  size_t passphraselen = strnlen(passphrase, 256);
 #if USE_BIP39_CACHE
   // check cache
   if (mnemoniclen < 256 && passphraselen < 64) {
@@ -219,7 +220,7 @@ void mnemonic_to_seed(const char *mnemonic, const char *passphrase,
   if (progress_callback) {
     progress_callback(0, BIP39_PBKDF2_ROUNDS);
   }
-  for (int i = 0; i < 16; i++) {
+  for (uint32_t i = 0; i < 16; i++) {
     pbkdf2_hmac_sha512_Update(&pctx, BIP39_PBKDF2_ROUNDS / 16);
     if (progress_callback) {
       progress_callback((i + 1) * BIP39_PBKDF2_ROUNDS / 16,
@@ -262,7 +263,7 @@ found_word mnemonic_find_word(const char *word) {
   return (found_word){.index = result_index, .length = result_length};
 }
 
-const char *mnemonic_complete_word(const char *prefix, int len) {
+const char *mnemonic_complete_word(const char *prefix, size_t len) {
   // we need to perform linear search,
   // because we want to return the first match
   for (int i = 0; i < BIP39_WORD_COUNT; i++) {
@@ -281,8 +282,8 @@ const char *mnemonic_get_word(int index) {
   }
 }
 
-uint32_t mnemonic_word_completion_mask(const char *prefix, int len) {
-  if (len <= 0) {
+uint32_t mnemonic_word_completion_mask(const char *prefix, size_t len) {
+  if (len == 0) {
     return 0x3ffffff;  // all letters (bits 1-26 set)
   }
   uint32_t res = 0;
diff --git a/crypto/bip39.h b/crypto/bip39.h
index 2a2c5cc1..f17b5279 100644
--- a/crypto/bip39.h
+++ b/crypto/bip39.h
@@ -43,12 +43,14 @@ void bip39_cache_clear(void);
 
 extern const char *const BIP39_WORDLIST_ENGLISH[BIP39_WORD_COUNT];
 
-const char *mnemonic_from_data(const uint8_t *data, int len);
+const char *mnemonic_from_data(const uint8_t *data, size_t len);
 void mnemonic_clear(void);
 
 int mnemonic_check(const char *mnemonic);
 
-int mnemonic_to_bits(const char *mnemonic, uint8_t *bits);
+// Returns the number of bits written to `bits`, or 0 if the mnemonic is
+// invalid.
+size_t mnemonic_to_bits(const char *mnemonic, uint8_t *bits);
 
 // passphrase must be at most 256 characters otherwise it would be truncated
 void mnemonic_to_seed(const char *mnemonic, const char *passphrase,
@@ -62,8 +64,8 @@ typedef struct {
 } found_word;
 
 found_word mnemonic_find_word(const char *word);
-const char *mnemonic_complete_word(const char *prefix, int len);
+const char *mnemonic_complete_word(const char *prefix, size_t len);
 const char *mnemonic_get_word(int index);
-uint32_t mnemonic_word_completion_mask(const char *prefix, int len);
+uint32_t mnemonic_word_completion_mask(const char *prefix, size_t len);
 
 #endif
diff --git a/crypto/cardano.c b/crypto/cardano.c
index a9c5668e..b526290c 100644
--- a/crypto/cardano.c
+++ b/crypto/cardano.c
@@ -84,7 +84,7 @@ int hdnode_private_ckd_cardano(HDNode *inout, uint32_t index) {
 
   // checks for hardened/non-hardened derivation, keysize 32 means we are
   // dealing with public key and thus non-h, keysize 64 is for private key
-  int keysize = 32;
+  size_t keysize = 32;
   if (index & 0x80000000) {
     keysize = 64;
   }
@@ -180,7 +180,7 @@ int hdnode_from_secret_cardano(const uint8_t secret[CARDANO_SECRET_LENGTH],
 
 // Derives the root Cardano secret from a master secret, aka seed, as defined in
 // SLIP-0023.
-int secret_from_seed_cardano_slip23(const uint8_t *seed, int seed_len,
+int secret_from_seed_cardano_slip23(const uint8_t *seed, size_t seed_len,
                                     uint8_t secret_out[CARDANO_SECRET_LENGTH]) {
   LOCAL_CONFIDENTIAL uint8_t I[SHA512_DIGEST_LENGTH];
   LOCAL_CONFIDENTIAL HMAC_SHA512_CTX ctx;
@@ -203,7 +203,7 @@ int secret_from_seed_cardano_slip23(const uint8_t *seed, int seed_len,
 // Derives the root Cardano secret from a BIP-32 master secret via the Ledger
 // derivation:
 // https://github.com/cardano-foundation/CIPs/blob/09d7d8ee1bd64f7e6b20b5a6cae088039dce00cb/CIP-0003/Ledger.md
-int secret_from_seed_cardano_ledger(const uint8_t *seed, int seed_len,
+int secret_from_seed_cardano_ledger(const uint8_t *seed, size_t seed_len,
                                     uint8_t secret_out[CARDANO_SECRET_LENGTH]) {
   LOCAL_CONFIDENTIAL uint8_t chain_code[SHA256_DIGEST_LENGTH];
   LOCAL_CONFIDENTIAL uint8_t root_key[SHA512_DIGEST_LENGTH];
@@ -211,7 +211,7 @@ int secret_from_seed_cardano_ledger(const uint8_t *seed, int seed_len,
   LOCAL_CONFIDENTIAL HMAC_SHA512_CTX sctx;
 
   const uint8_t *intermediate_result = seed;
-  int intermediate_result_len = seed_len;
+  size_t intermediate_result_len = seed_len;
   do {
     // STEP 1: derive a master secret like in BIP-32/SLIP-10
     hmac_sha512_Init(&sctx, (const uint8_t *)ED25519_SEED_NAME,
@@ -262,8 +262,8 @@ _Static_assert(
 // scheme:
 // https://github.com/cardano-foundation/CIPs/blob/09d7d8ee1bd64f7e6b20b5a6cae088039dce00cb/CIP-0003/Icarus.md
 int secret_from_entropy_cardano_icarus(
-    const uint8_t *pass, int pass_len, const uint8_t *entropy, int entropy_len,
-    uint8_t secret_out[CARDANO_SECRET_LENGTH],
+    const uint8_t *pass, size_t pass_len, const uint8_t *entropy,
+    size_t entropy_len, uint8_t secret_out[CARDANO_SECRET_LENGTH],
     void (*progress_callback)(uint32_t, uint32_t)) {
   LOCAL_CONFIDENTIAL PBKDF2_HMAC_SHA512_CTX pctx;
   LOCAL_CONFIDENTIAL uint8_t digest[SHA512_DIGEST_LENGTH];
diff --git a/crypto/cardano.h b/crypto/cardano.h
index b5a8b0b3..8042817b 100644
--- a/crypto/cardano.h
+++ b/crypto/cardano.h
@@ -24,6 +24,7 @@
 #define __CARDANO_H__
 
 #include <stdbool.h>
+#include <stddef.h>
 #include <stdint.h>
 #include "bip32.h"
 #include "options.h"
@@ -38,12 +39,12 @@ extern const curve_info ed25519_cardano_info;
 int hdnode_private_ckd_cardano(HDNode *inout, uint32_t i);
 
 int secret_from_entropy_cardano_icarus(
-    const uint8_t *pass, int pass_len, const uint8_t *entropy, int entropy_len,
-    uint8_t secret_out[CARDANO_SECRET_LENGTH],
+    const uint8_t *pass, size_t pass_len, const uint8_t *entropy,
+    size_t entropy_len, uint8_t secret_out[CARDANO_SECRET_LENGTH],
     void (*progress_callback)(uint32_t current, uint32_t total));
-int secret_from_seed_cardano_ledger(const uint8_t *seed, int seed_len,
+int secret_from_seed_cardano_ledger(const uint8_t *seed, size_t seed_len,
                                     uint8_t secret_out[CARDANO_SECRET_LENGTH]);
-int secret_from_seed_cardano_slip23(const uint8_t *seed, int seed_len,
+int secret_from_seed_cardano_slip23(const uint8_t *seed, size_t seed_len,
                                     uint8_t secret_out[CARDANO_SECRET_LENGTH]);
 
 int hdnode_from_secret_cardano(const uint8_t secret[CARDANO_SECRET_LENGTH],
diff --git a/crypto/ecdsa.c b/crypto/ecdsa.c
index 57f87329..4baaadc3 100644
--- a/crypto/ecdsa.c
+++ b/crypto/ecdsa.c
@@ -877,7 +877,7 @@ void ecdsa_get_address_raw(const uint8_t *pub_key, uint32_t version,
 
 void ecdsa_get_address(const uint8_t *pub_key, uint32_t version,
                        HasherType hasher_pubkey, HasherType hasher_base58,
-                       char *addr, int addrsize) {
+                       char *addr, size_t addrsize) {
   uint8_t raw[MAX_ADDR_RAW_SIZE] = {0};
   size_t prefix_len = address_prefix_bytes_len(version);
   ecdsa_get_address_raw(pub_key, version, hasher_pubkey, raw);
@@ -901,7 +901,7 @@ void ecdsa_get_address_segwit_p2sh_raw(const uint8_t *pub_key, uint32_t version,
 void ecdsa_get_address_segwit_p2sh(const uint8_t *pub_key, uint32_t version,
                                    HasherType hasher_pubkey,
                                    HasherType hasher_base58, char *addr,
-                                   int addrsize) {
+                                   size_t addrsize) {
   uint8_t raw[MAX_ADDR_RAW_SIZE] = {0};
   size_t prefix_len = address_prefix_bytes_len(version);
   ecdsa_get_address_segwit_p2sh_raw(pub_key, version, hasher_pubkey, raw);
@@ -910,7 +910,7 @@ void ecdsa_get_address_segwit_p2sh(const uint8_t *pub_key, uint32_t version,
 }
 
 void ecdsa_get_wif(const uint8_t *priv_key, uint32_t version,
-                   HasherType hasher_base58, char *wif, int wifsize) {
+                   HasherType hasher_base58, char *wif, size_t wifsize) {
   uint8_t wif_raw[MAX_WIF_RAW_SIZE] = {0};
   size_t prefix_len = address_prefix_bytes_len(version);
   address_write_prefix_bytes(version, wif_raw);
@@ -925,7 +925,7 @@ void ecdsa_get_wif(const uint8_t *priv_key, uint32_t version,
 int ecdsa_address_decode(const char *addr, uint32_t version,
                          HasherType hasher_base58, uint8_t *out) {
   if (!addr) return 0;
-  int prefix_len = address_prefix_bytes_len(version);
+  size_t prefix_len = address_prefix_bytes_len(version);
   return base58_decode_check(addr, hasher_base58, out, 20 + prefix_len) ==
              20 + prefix_len &&
          address_check_prefix(out, version);
diff --git a/crypto/ecdsa.h b/crypto/ecdsa.h
index f3d7698f..fea6cc97 100644
--- a/crypto/ecdsa.h
+++ b/crypto/ecdsa.h
@@ -108,16 +108,16 @@ void ecdsa_get_address_raw(const uint8_t *pub_key, uint32_t version,
                            HasherType hasher_pubkey, uint8_t *addr_raw);
 void ecdsa_get_address(const uint8_t *pub_key, uint32_t version,
                        HasherType hasher_pubkey, HasherType hasher_base58,
-                       char *addr, int addrsize);
+                       char *addr, size_t addrsize);
 void ecdsa_get_address_segwit_p2sh_raw(const uint8_t *pub_key, uint32_t version,
                                        HasherType hasher_pubkey,
                                        uint8_t *addr_raw);
 void ecdsa_get_address_segwit_p2sh(const uint8_t *pub_key, uint32_t version,
                                    HasherType hasher_pubkey,
                                    HasherType hasher_base58, char *addr,
-                                   int addrsize);
+                                   size_t addrsize);
 void ecdsa_get_wif(const uint8_t *priv_key, uint32_t version,
-                   HasherType hasher_base58, char *wif, int wifsize);
+                   HasherType hasher_base58, char *wif, size_t wifsize);
 
 int ecdsa_address_decode(const char *addr, uint32_t version,
                          HasherType hasher_base58, uint8_t *out);
diff --git a/crypto/fuzzer/fuzzer.c b/crypto/fuzzer/fuzzer.c
index c235a0e5..8a367fd2 100644
--- a/crypto/fuzzer/fuzzer.c
+++ b/crypto/fuzzer/fuzzer.c
@@ -342,7 +342,7 @@ int fuzz_base58_encode_check(void) {
   size_t raw_inlen = fuzzer_length;
   memcpy(in_buffer, fuzzer_input(raw_inlen), raw_inlen);
 
-  int ret = 0;
+  size_t ret = 0;
   // run multiple hasher variants for the same input
   base58_encode_check(in_buffer, raw_inlen, HASHER_SHA2D, out_buffer, outlen);
   base58_encode_check(in_buffer, raw_inlen, HASHER_BLAKED, out_buffer, outlen);
diff --git a/crypto/pbkdf2.c b/crypto/pbkdf2.c
index d9e14229..eae8edb2 100644
--- a/crypto/pbkdf2.c
+++ b/crypto/pbkdf2.c
@@ -28,8 +28,8 @@
 #include "sha2.h"
 
 void pbkdf2_hmac_sha256_Init(PBKDF2_HMAC_SHA256_CTX *pctx, const uint8_t *pass,
-                             int passlen, const uint8_t *salt, int saltlen,
-                             uint32_t blocknr) {
+                             size_t passlen, const uint8_t *salt,
+                             size_t saltlen, uint32_t blocknr) {
   SHA256_CTX ctx = {0};
 #if BYTE_ORDER == LITTLE_ENDIAN
   REVERSE32(blocknr, blocknr);
@@ -77,11 +77,11 @@ void pbkdf2_hmac_sha256_Final(PBKDF2_HMAC_SHA256_CTX *pctx, uint8_t *key) {
   memzero(pctx, sizeof(PBKDF2_HMAC_SHA256_CTX));
 }
 
-void pbkdf2_hmac_sha256(const uint8_t *pass, int passlen, const uint8_t *salt,
-                        int saltlen, uint32_t iterations, uint8_t *key,
-                        int keylen) {
-  uint32_t last_block_size = keylen % SHA256_DIGEST_LENGTH;
-  uint32_t blocks_count = keylen / SHA256_DIGEST_LENGTH;
+void pbkdf2_hmac_sha256(const uint8_t *pass, size_t passlen,
+                        const uint8_t *salt, size_t saltlen,
+                        uint32_t iterations, uint8_t *key, size_t keylen) {
+  size_t last_block_size = keylen % SHA256_DIGEST_LENGTH;
+  size_t blocks_count = keylen / SHA256_DIGEST_LENGTH;
   if (last_block_size) {
     blocks_count++;
   } else {
@@ -93,7 +93,7 @@ void pbkdf2_hmac_sha256(const uint8_t *pass, int passlen, const uint8_t *salt,
     pbkdf2_hmac_sha256_Update(&pctx, iterations);
     uint8_t digest[SHA256_DIGEST_LENGTH] = {0};
     pbkdf2_hmac_sha256_Final(&pctx, digest);
-    uint32_t key_offset = (blocknr - 1) * SHA256_DIGEST_LENGTH;
+    size_t key_offset = (size_t)(blocknr - 1) * SHA256_DIGEST_LENGTH;
     if (blocknr < blocks_count) {
       memcpy(key + key_offset, digest, SHA256_DIGEST_LENGTH);
     } else {
@@ -103,8 +103,8 @@ void pbkdf2_hmac_sha256(const uint8_t *pass, int passlen, const uint8_t *salt,
 }
 
 void pbkdf2_hmac_sha512_Init(PBKDF2_HMAC_SHA512_CTX *pctx, const uint8_t *pass,
-                             int passlen, const uint8_t *salt, int saltlen,
-                             uint32_t blocknr) {
+                             size_t passlen, const uint8_t *salt,
+                             size_t saltlen, uint32_t blocknr) {
   SHA512_CTX ctx = {0};
 #if BYTE_ORDER == LITTLE_ENDIAN
   REVERSE32(blocknr, blocknr);
@@ -153,11 +153,11 @@ void pbkdf2_hmac_sha512_Final(PBKDF2_HMAC_SHA512_CTX *pctx, uint8_t *key) {
   memzero(pctx, sizeof(PBKDF2_HMAC_SHA512_CTX));
 }
 
-void pbkdf2_hmac_sha512(const uint8_t *pass, int passlen, const uint8_t *salt,
-                        int saltlen, uint32_t iterations, uint8_t *key,
-                        int keylen) {
-  uint32_t last_block_size = keylen % SHA512_DIGEST_LENGTH;
-  uint32_t blocks_count = keylen / SHA512_DIGEST_LENGTH;
+void pbkdf2_hmac_sha512(const uint8_t *pass, size_t passlen,
+                        const uint8_t *salt, size_t saltlen,
+                        uint32_t iterations, uint8_t *key, size_t keylen) {
+  size_t last_block_size = keylen % SHA512_DIGEST_LENGTH;
+  size_t blocks_count = keylen / SHA512_DIGEST_LENGTH;
   if (last_block_size) {
     blocks_count++;
   } else {
@@ -169,7 +169,7 @@ void pbkdf2_hmac_sha512(const uint8_t *pass, int passlen, const uint8_t *salt,
     pbkdf2_hmac_sha512_Update(&pctx, iterations);
     uint8_t digest[SHA512_DIGEST_LENGTH] = {0};
     pbkdf2_hmac_sha512_Final(&pctx, digest);
-    uint32_t key_offset = (blocknr - 1) * SHA512_DIGEST_LENGTH;
+    size_t key_offset = (size_t)(blocknr - 1) * SHA512_DIGEST_LENGTH;
     if (blocknr < blocks_count) {
       memcpy(key + key_offset, digest, SHA512_DIGEST_LENGTH);
     } else {
diff --git a/crypto/pbkdf2.h b/crypto/pbkdf2.h
index c2e3f04a..2e253f5d 100644
--- a/crypto/pbkdf2.h
+++ b/crypto/pbkdf2.h
@@ -24,6 +24,7 @@
 #ifndef __PBKDF2_H__
 #define __PBKDF2_H__
 
+#include <stddef.h>
 #include <stdint.h>
 #include "sha2.h"
 
@@ -44,23 +45,23 @@ typedef struct _PBKDF2_HMAC_SHA512_CTX {
 } PBKDF2_HMAC_SHA512_CTX;
 
 void pbkdf2_hmac_sha256_Init(PBKDF2_HMAC_SHA256_CTX *pctx, const uint8_t *pass,
-                             int passlen, const uint8_t *salt, int saltlen,
-                             uint32_t blocknr);
+                             size_t passlen, const uint8_t *salt,
+                             size_t saltlen, uint32_t blocknr);
 void pbkdf2_hmac_sha256_Update(PBKDF2_HMAC_SHA256_CTX *pctx,
                                uint32_t iterations);
 void pbkdf2_hmac_sha256_Final(PBKDF2_HMAC_SHA256_CTX *pctx, uint8_t *key);
-void pbkdf2_hmac_sha256(const uint8_t *pass, int passlen, const uint8_t *salt,
-                        int saltlen, uint32_t iterations, uint8_t *key,
-                        int keylen);
+void pbkdf2_hmac_sha256(const uint8_t *pass, size_t passlen,
+                        const uint8_t *salt, size_t saltlen,
+                        uint32_t iterations, uint8_t *key, size_t keylen);
 
 void pbkdf2_hmac_sha512_Init(PBKDF2_HMAC_SHA512_CTX *pctx, const uint8_t *pass,
-                             int passlen, const uint8_t *salt, int saltlen,
-                             uint32_t blocknr);
+                             size_t passlen, const uint8_t *salt,
+                             size_t saltlen, uint32_t blocknr);
 void pbkdf2_hmac_sha512_Update(PBKDF2_HMAC_SHA512_CTX *pctx,
                                uint32_t iterations);
 void pbkdf2_hmac_sha512_Final(PBKDF2_HMAC_SHA512_CTX *pctx, uint8_t *key);
-void pbkdf2_hmac_sha512(const uint8_t *pass, int passlen, const uint8_t *salt,
-                        int saltlen, uint32_t iterations, uint8_t *key,
-                        int keylen);
+void pbkdf2_hmac_sha512(const uint8_t *pass, size_t passlen,
+                        const uint8_t *salt, size_t saltlen,
+                        uint32_t iterations, uint8_t *key, size_t keylen);
 
 #endif
diff --git a/crypto/rand.c b/crypto/rand.c
index 612e5c0a..b8426cdf 100644
--- a/crypto/rand.c
+++ b/crypto/rand.c
@@ -31,7 +31,7 @@ uint32_t random_uniform(uint32_t n) {
 
 void random_permute(char *str, size_t len) {
   for (int i = len - 1; i >= 1; i--) {
-    int j = random_uniform(i + 1);
+    uint32_t j = random_uniform(i + 1);
     char t = str[j];
     str[j] = str[i];
     str[i] = t;
diff --git a/crypto/script.c b/crypto/script.c
index cbc71b21..70a71add 100644
--- a/crypto/script.c
+++ b/crypto/script.c
@@ -24,8 +24,8 @@
 #include <string.h>
 #include "base58.h"
 
-int script_output_to_address(const uint8_t *script, int scriptlen, char *addr,
-                             int addrsize) {
+size_t script_output_to_address(const uint8_t *script, size_t scriptlen,
+                                char *addr, size_t addrsize) {
   uint8_t raw[35] = {0};
 
   // P2PKH
diff --git a/crypto/script.h b/crypto/script.h
index c9cc003b..0374fbd8 100644
--- a/crypto/script.h
+++ b/crypto/script.h
@@ -23,9 +23,10 @@
 #ifndef __SCRIPT_H__
 #define __SCRIPT_H__
 
+#include <stddef.h>
 #include <stdint.h>
 
-int script_output_to_address(const uint8_t *script, int scriptlen, char *addr,
-                             int addrsize);
+size_t script_output_to_address(const uint8_t *script, size_t scriptlen,
+                                char *addr, size_t addrsize);
 
 #endif
diff --git a/crypto/tests/test_check.c b/crypto/tests/test_check.c
index 57daad63..549605a6 100644
--- a/crypto/tests/test_check.c
+++ b/crypto/tests/test_check.c
@@ -1194,17 +1194,17 @@ START_TEST(test_base58) {
   const char **str = base58_vector + 1;
   uint8_t rawn[34];
   char strn[53];
-  int r;
+  size_t r;
   while (*raw && *str) {
-    int len = strlen(*raw) / 2;
+    size_t len = strlen(*raw) / 2;
 
     memcpy(rawn, fromhex(*raw), len);
     r = base58_encode_check(rawn, len, HASHER_SHA2D, strn, sizeof(strn));
-    ck_assert_int_eq((size_t)r, strlen(*str) + 1);
+    ck_assert_uint_eq(r, strlen(*str) + 1);
     ck_assert_str_eq(strn, *str);
 
     r = base58_decode_check(strn, HASHER_SHA2D, rawn, len);
-    ck_assert_int_eq(r, len);
+    ck_assert_uint_eq(r, len);
     ck_assert_mem_eq(rawn, fromhex(*raw), len);
 
     raw += 2;
@@ -6952,10 +6952,10 @@ START_TEST(test_mnemonic_to_bits) {
   a = vectors;
   b = vectors + 1;
   while (*a && *b) {
-    int mnemonic_bits_len = mnemonic_to_bits(*b, mnemonic_bits);
-    ck_assert_int_eq(mnemonic_bits_len % 33, 0);
+    size_t mnemonic_bits_len = mnemonic_to_bits(*b, mnemonic_bits);
+    ck_assert_uint_eq(mnemonic_bits_len % 33, 0);
     mnemonic_bits_len = mnemonic_bits_len * 4 / 33;
-    ck_assert_uint_eq((size_t)mnemonic_bits_len, strlen(*a) / 2);
+    ck_assert_uint_eq(mnemonic_bits_len, strlen(*a) / 2);
     ck_assert_mem_eq(mnemonic_bits, fromhex(*a), mnemonic_bits_len);
     a += 2;
     b += 2;
@@ -8568,9 +8568,10 @@ static void test_bip32_ecdh_init_node(HDNode *node, const char *seed_str,
   }
 }
 
-static void test_bip32_ecdh(const char *curve_name, int expected_key_size,
+static void test_bip32_ecdh(const char *curve_name, size_t expected_key_size,
                             const uint8_t *expected_key) {
-  int res, key_size;
+  int res;
+  size_t key_size;
   HDNode alice, bob;
   uint8_t session_key1[expected_key_size], session_key2[expected_key_size];
 
@@ -8580,13 +8581,13 @@ static void test_bip32_ecdh(const char *curve_name, int expected_key_size,
   // Generate shared key from Alice's secret key and Bob's public key
   res = hdnode_get_shared_key(&alice, bob.public_key, session_key1, &key_size);
   ck_assert_int_eq(res, 0);
-  ck_assert_int_eq(key_size, expected_key_size);
+  ck_assert_uint_eq(key_size, expected_key_size);
   ck_assert_mem_eq(session_key1, expected_key, key_size);
 
   // Generate shared key from Bob's secret key and Alice's public key
   res = hdnode_get_shared_key(&bob, alice.public_key, session_key2, &key_size);
   ck_assert_int_eq(res, 0);
-  ck_assert_int_eq(key_size, expected_key_size);
+  ck_assert_uint_eq(key_size, expected_key_size);
   ck_assert_mem_eq(session_key2, expected_key, key_size);
 }
 
@@ -8610,22 +8611,23 @@ START_TEST(test_bip32_ecdh_errors) {
   HDNode node;
   const uint8_t peer_public_key[65] = {0};  // invalid public key
   uint8_t session_key[65];
-  int res, key_size = 0;
+  int res;
+  size_t key_size = 0;
 
   test_bip32_ecdh_init_node(&node, "Seed", ED25519_NAME);
   res = hdnode_get_shared_key(&node, peer_public_key, session_key, &key_size);
   ck_assert_int_eq(res, 1);
-  ck_assert_int_eq(key_size, 0);
+  ck_assert_uint_eq(key_size, 0);
 
   test_bip32_ecdh_init_node(&node, "Seed", CURVE25519_NAME);
   res = hdnode_get_shared_key(&node, peer_public_key, session_key, &key_size);
   ck_assert_int_eq(res, 1);
-  ck_assert_int_eq(key_size, 0);
+  ck_assert_uint_eq(key_size, 0);
 
   test_bip32_ecdh_init_node(&node, "Seed", NIST256P1_NAME);
   res = hdnode_get_shared_key(&node, peer_public_key, session_key, &key_size);
   ck_assert_int_eq(res, 1);
-  ck_assert_int_eq(key_size, 0);
+  ck_assert_uint_eq(key_size, 0);
 }
 END_TEST
 
@@ -8647,9 +8649,9 @@ START_TEST(test_output_script) {
   adr = vectors + 1;
   char address[60];
   while (*scr && *adr) {
-    int r =
+    size_t r =
         script_output_to_address(fromhex(*scr), strlen(*scr) / 2, address, 60);
-    ck_assert_uint_eq((size_t)r, strlen(*adr) + 1);
+    ck_assert_uint_eq(r, strlen(*adr) + 1);
     ck_assert_str_eq(address, *adr);
     scr += 2;
     adr += 2;
diff --git a/crypto/tests/test_check_cardano.h b/crypto/tests/test_check_cardano.h
index 4f31a553..3d14f087 100644
--- a/crypto/tests/test_check_cardano.h
+++ b/crypto/tests/test_check_cardano.h
@@ -113,11 +113,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_1) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -159,11 +159,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_2) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -200,11 +200,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_3) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -241,11 +241,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_4) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -283,11 +283,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_5) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -326,11 +326,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_6) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -370,11 +370,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_7) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "ring crime symptom enough erupt lady behave ramp apart settle citizen "
       "junk",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 132);
+  ck_assert_uint_eq(mnemonic_bits_len, 132);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -415,11 +415,11 @@ START_TEST(test_bip32_cardano_hdnode_vector_8) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "found differ bulb shadow wrist blue bind vessel deposit tip pelican "
       "action surprise weapon check fiction muscle this",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 198);
+  ck_assert_uint_eq(mnemonic_bits_len, 198);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
@@ -460,12 +460,12 @@ START_TEST(test_bip32_cardano_hdnode_vector_9) {
 
   uint8_t mnemonic_bits[66];
   uint8_t cardano_secret[CARDANO_SECRET_LENGTH];
-  int mnemonic_bits_len = mnemonic_to_bits(
+  size_t mnemonic_bits_len = mnemonic_to_bits(
       "balance exotic ranch knife glory slow tape favorite yard gym awake "
       "ill exist useless parent aim pig stay effort into square gasp credit "
       "butter",
       mnemonic_bits);
-  ck_assert_int_eq(mnemonic_bits_len, 264);
+  ck_assert_uint_eq(mnemonic_bits_len, 264);
   secret_from_entropy_cardano_icarus((const uint8_t *)"", 0, mnemonic_bits,
                                      mnemonic_bits_len / 8, cardano_secret,
                                      NULL);
diff --git a/crypto/tests/test_wycheproof.py b/crypto/tests/test_wycheproof.py
index 51b79747..f41d3e2b 100755
--- a/crypto/tests/test_wycheproof.py
+++ b/crypto/tests/test_wycheproof.py
@@ -894,21 +894,21 @@ lib.aes_ccm_decrypt.argtypes = [
 lib.aes_ccm_decrypt.restype = ctypes.c_int
 lib.pbkdf2_hmac_sha256.argtypes = [
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
     ctypes.c_uint32,
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
 ]
 lib.pbkdf2_hmac_sha512.argtypes = [
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
     ctypes.c_uint32,
     ctypes.c_char_p,
-    ctypes.c_int,
+    ctypes.c_size_t,
 ]
 
 curve25519_dh_vectors = generate_curve25519_dh("x25519_test.json")
diff --git a/legacy/firmware/coins.c b/legacy/firmware/coins.c
index 7def8d9f..f851e420 100644
--- a/legacy/firmware/coins.c
+++ b/legacy/firmware/coins.c
@@ -61,8 +61,8 @@ bool coinExtractAddressType(const CoinInfo *coin, const char *addr,
                             uint32_t *address_type) {
   if (!addr) return false;
   uint8_t addr_raw[MAX_ADDR_RAW_SIZE] = {0};
-  int len = base58_decode_check(addr, coin->curve->hasher_base58, addr_raw,
-                                MAX_ADDR_RAW_SIZE);
+  size_t len = base58_decode_check(addr, coin->curve->hasher_base58, addr_raw,
+                                   MAX_ADDR_RAW_SIZE);
   if (len >= 21) {
     return coinExtractAddressTypeRaw(coin, addr_raw, address_type);
   }
diff --git a/legacy/firmware/fsm_msg_crypto.h b/legacy/firmware/fsm_msg_crypto.h
index ff5c003e..f34b2733 100644
--- a/legacy/firmware/fsm_msg_crypto.h
+++ b/legacy/firmware/fsm_msg_crypto.h
@@ -213,7 +213,7 @@ void fsm_msgGetECDHSessionKey(const GetECDHSessionKey *msg) {
   HDNode *node = fsm_getDerivedNode(curve, address_n, 5, NULL);
   if (!node) return;
 
-  int result_size = 0;
+  size_t result_size = 0;
   if (hdnode_get_shared_key(node, msg->peer_public_key.bytes,
                             resp->session_key.bytes, &result_size) == 0) {
     resp->session_key.size = result_size;