@@ -274,9 +274,10 @@ MaybeLocal<Value> KmacTraits::EncodeOutput(Environment* env,
     case SignConfiguration::Mode::Verify:
       return Boolean::New(
           env->isolate(),
-          out->size() > 0 && out->size() == params.signature.size() &&
-              CRYPTO_memcmp(
-                  out->data(), params.signature.data(), out->size()) == 0);
+          out->size() == params.signature.size() &&
+              (out->size() == 0 ||
+               CRYPTO_memcmp(
+                   out->data(), params.signature.data(), out->size()) == 0));
   }
   UNREACHABLE();
 }
 
@@ -0,0 +1,42 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3))
+  common.skip('requires OpenSSL >= 3');
+if (hasFIPS())
+  common.skip('empty KMAC output is not supported in FIPS mode');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+
+(async () => {
+  const data = new Uint8Array([1, 2, 3]);
+
+  for (const name of ['KMAC128', 'KMAC256']) {
+    const key = await subtle.importKey(
+      'raw-secret', new Uint8Array(32), name, false, ['sign', 'verify']);
+    const otherKey = await subtle.importKey(
+      'raw-secret', new Uint8Array(32).fill(1), name, false, ['verify']);
+    const algorithm = { name, outputLength: 0 };
+    const signature = await subtle.sign(algorithm, key, data);
+
+    assert.strictEqual(signature.byteLength, 0);
+    assert.strictEqual(await subtle.verify(algorithm, key, signature, data), true);
+    assert.strictEqual(await subtle.verify(algorithm, key, new Uint8Array([0]), data), false);
+    assert.strictEqual(await subtle.verify(
+      { name, outputLength: 256 }, key, signature, data), false);
+
+    // Empty MACs compare equal even when the inputs differ.
+    assert.strictEqual(await subtle.verify(
+      algorithm, key, signature, new Uint8Array([4, 5, 6])), true);
+    assert.strictEqual(await subtle.verify(algorithm, otherKey, signature, data), true);
+    assert.strictEqual(await subtle.verify(
+      { ...algorithm, customization: new Uint8Array([1]) }, key, signature, data), true);
+  }
+})().then(common.mustCall());
Original file line number	Diff line number	Diff line change
`@@ -274,9 +274,10 @@ MaybeLocal<Value> KmacTraits::EncodeOutput(Environment* env,`
`274`	`274`	`case SignConfiguration::Mode::Verify:`
`275`	`275`	`return Boolean::New(`
`276`	`276`	`env->isolate(),`
`277`		`- out->size() > 0 && out->size() == params.signature.size() &&`
`278`		`- CRYPTO_memcmp(`
`279`		`- out->data(), params.signature.data(), out->size()) == 0);`
	`277`	`+ out->size() == params.signature.size() &&`
	`278`	`+ (out->size() == 0 \|\|`
	`279`	`+ CRYPTO_memcmp(`
	`280`	`+ out->data(), params.signature.data(), out->size()) == 0));`
`280`	`281`	`}`
`281`	`282`	`UNREACHABLE();`
`282`	`283`	`}`