diff --git a/include/openssl/base.h b/include/openssl/base.h
index 1e61e98..a2fb76b 100644
--- a/include/openssl/base.h
+++ b/include/openssl/base.h
@@ -335,6 +335,10 @@
 // are sizes of or indices into C objects, can be converted without overflow.
 typedef ptrdiff_t ossl_ssize_t;
 
+// CBS_ASN1_TAG is the type used by |CBS| and |CBB| for ASN.1 tags. See that
+// header for details. This type is defined in base.h as a forward declaration.
+typedef uint32_t CBS_ASN1_TAG;
+
 // CRYPTO_THREADID is a dummy value.
 typedef int CRYPTO_THREADID;
 
diff --git a/include/openssl/bytestring.h b/include/openssl/bytestring.h
index 5496644..28297d4 100644
--- a/include/openssl/bytestring.h
+++ b/include/openssl/bytestring.h
@@ -169,8 +169,8 @@
 // SEQUENCE, branching on CHOICEs or OPTIONAL fields, checking for trailing
 // data, and handling explict vs. implicit tagging.
 //
-// Tags are represented as |unsigned| values in memory. The upper few bits store
-// the class and constructed bit, and the remaining bits store the tag
+// Tags are represented as |CBS_ASN1_TAG| values in memory. The upper few bits
+// store the class and constructed bit, and the remaining bits store the tag
 // number. Note this differs from the DER serialization, to support tag numbers
 // beyond 31. Consumers must use the constants defined below to decompose or
 // assemble tags.
@@ -231,31 +231,33 @@
 // including tag and length bytes) and advances |cbs| over it. The ASN.1
 // element must match |tag_value|. It returns one on success and zero
 // on error.
-OPENSSL_EXPORT int CBS_get_asn1(CBS *cbs, CBS *out, unsigned tag_value);
+OPENSSL_EXPORT int CBS_get_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG tag_value);
 
 // CBS_get_asn1_element acts like |CBS_get_asn1| but |out| will include the
 // ASN.1 header bytes too.
-OPENSSL_EXPORT int CBS_get_asn1_element(CBS *cbs, CBS *out, unsigned tag_value);
+OPENSSL_EXPORT int CBS_get_asn1_element(CBS *cbs, CBS *out,
+                                        CBS_ASN1_TAG tag_value);
 
 // CBS_peek_asn1_tag looks ahead at the next ASN.1 tag and returns one
 // if the next ASN.1 element on |cbs| would have tag |tag_value|. If
 // |cbs| is empty or the tag does not match, it returns zero. Note: if
 // it returns one, CBS_get_asn1 may still fail if the rest of the
 // element is malformed.
-OPENSSL_EXPORT int CBS_peek_asn1_tag(const CBS *cbs, unsigned tag_value);
+OPENSSL_EXPORT int CBS_peek_asn1_tag(const CBS *cbs, CBS_ASN1_TAG tag_value);
 
 // CBS_get_any_asn1 sets |*out| to contain the next ASN.1 element from |*cbs|
 // (not including tag and length bytes), sets |*out_tag| to the tag number, and
 // advances |*cbs|. It returns one on success and zero on error. Either of |out|
 // and |out_tag| may be NULL to ignore the value.
-OPENSSL_EXPORT int CBS_get_any_asn1(CBS *cbs, CBS *out, unsigned *out_tag);
+OPENSSL_EXPORT int CBS_get_any_asn1(CBS *cbs, CBS *out,
+                                    CBS_ASN1_TAG *out_tag);
 
 // CBS_get_any_asn1_element sets |*out| to contain the next ASN.1 element from
 // |*cbs| (including header bytes) and advances |*cbs|. It sets |*out_tag| to
 // the tag number and |*out_header_len| to the length of the ASN.1 header. Each
 // of |out|, |out_tag|, and |out_header_len| may be NULL to ignore the value.
 OPENSSL_EXPORT int CBS_get_any_asn1_element(CBS *cbs, CBS *out,
-                                            unsigned *out_tag,
+                                            CBS_ASN1_TAG *out_tag,
                                             size_t *out_header_len);
 
 // CBS_get_any_ber_asn1_element acts the same as |CBS_get_any_asn1_element| but
@@ -271,7 +273,7 @@
 // element. Callers parsing indefinite-length encoding must check for EOC
 // separately.
 OPENSSL_EXPORT int CBS_get_any_ber_asn1_element(CBS *cbs, CBS *out,
-                                                unsigned *out_tag,
+                                                CBS_ASN1_TAG *out_tag,
                                                 size_t *out_header_len,
                                                 int *out_ber_found,
                                                 int *out_indefinite);
@@ -297,7 +299,7 @@
 // one, otherwise zero. It returns one on success, whether or not the element
 // was present, and zero on decode failure.
 OPENSSL_EXPORT int CBS_get_optional_asn1(CBS *cbs, CBS *out, int *out_present,
-                                         unsigned tag);
+                                         CBS_ASN1_TAG tag);
 
 // CBS_get_optional_asn1_octet_string gets an optional
 // explicitly-tagged OCTET STRING from |cbs|. If present, it sets
@@ -307,7 +309,7 @@
 // present, and zero on decode failure.
 OPENSSL_EXPORT int CBS_get_optional_asn1_octet_string(CBS *cbs, CBS *out,
                                                       int *out_present,
-                                                      unsigned tag);
+                                                      CBS_ASN1_TAG tag);
 
 // CBS_get_optional_asn1_uint64 gets an optional explicitly-tagged
 // INTEGER from |cbs|. If present, it sets |*out| to the
@@ -315,7 +317,7 @@
 // on success, whether or not the element was present, and zero on
 // decode failure.
 OPENSSL_EXPORT int CBS_get_optional_asn1_uint64(CBS *cbs, uint64_t *out,
-                                                unsigned tag,
+                                                CBS_ASN1_TAG tag,
                                                 uint64_t default_value);
 
 // CBS_get_optional_asn1_bool gets an optional, explicitly-tagged BOOLEAN from
@@ -323,7 +325,8 @@
 // boolean. Otherwise, it sets |*out| to |default_value|. It returns one on
 // success, whether or not the element was present, and zero on decode
 // failure.
-OPENSSL_EXPORT int CBS_get_optional_asn1_bool(CBS *cbs, int *out, unsigned tag,
+OPENSSL_EXPORT int CBS_get_optional_asn1_bool(CBS *cbs, int *out,
+                                              CBS_ASN1_TAG tag,
                                               int default_value);
 
 // CBS_is_valid_asn1_bitstring returns one if |cbs| is a valid ASN.1 BIT STRING
@@ -502,7 +505,7 @@
 // CBB_add_asn1 sets |*out_contents| to a |CBB| into which the contents of an
 // ASN.1 object can be written. The |tag| argument will be used as the tag for
 // the object. It returns one on success or zero on error.
-OPENSSL_EXPORT int CBB_add_asn1(CBB *cbb, CBB *out_contents, unsigned tag);
+OPENSSL_EXPORT int CBB_add_asn1(CBB *cbb, CBB *out_contents, CBS_ASN1_TAG tag);
 
 // CBB_add_bytes appends |len| bytes from |data| to |cbb|. It returns one on
 // success and zero otherwise.
@@ -574,7 +577,7 @@
 // |tag| as the tag instead of INTEGER. This is useful if the INTEGER type uses
 // implicit tagging.
 OPENSSL_EXPORT int CBB_add_asn1_uint64_with_tag(CBB *cbb, uint64_t value,
-                                                unsigned tag);
+                                                CBS_ASN1_TAG tag);
 
 // CBB_add_asn1_int64 writes an ASN.1 INTEGER into |cbb| using |CBB_add_asn1|
 // and writes |value| in its contents. It returns one on success and zero on
@@ -585,7 +588,7 @@
 // as the tag instead of INTEGER. This is useful if the INTEGER type uses
 // implicit tagging.
 OPENSSL_EXPORT int CBB_add_asn1_int64_with_tag(CBB *cbb, int64_t value,
-                                               unsigned tag);
+                                               CBS_ASN1_TAG tag);
 
 // CBB_add_asn1_octet_string writes an ASN.1 OCTET STRING into |cbb| with the
 // given contents. It returns one on success and zero on error.