Is message integrity possible without confidentiality? Are there any mainstream protocols? I understand that many schemes that provide data integrity involve a hash-then-encrypt approach. I was wondering if data integrity is achievable without confidentiality? Are there any mainstream protocols for this?
Hash-then-encrypt is not a scheme that is used a lot. It may not be necessarily secure in all situations.



Instead message authentication codes (MAC) are used. These produce what is called an authentication tag (symbol: $t$); a fixed size, keyed hash over the processed data. Obviously, as a keyed hash it requires a key as input, preferably one specific for the MAC.

MAC can be split into hashes that are based on block ciphers or hashes. An example of a MAC is AES-CMAC; it is based on AES in CBC mode but it doesn't encrypt the plaintext (the intermediate ciphertext is not kept). It makes sense to use a block cipher based MAC if the block cipher - usually AES - can be used with hardware acceleration.

HMAC - which simply stands for Hash-based MAC - can be used with MD5, SHA-1 and SHA-2 as underlaying hash construct. As SHA-3 is already protected against length extension attacks it can be used with a more elegant approach called KMAC.



Nowadays authenticated ciphers such as AES-GMAC are becoming popular. Authenticated ciphers are usually AEAD ciphers: ciphers providing Authenticated Encryption with Associated Data. The associated data (AD) or additional authenticated data (AAD) within these schemes is also integrity protected and not encrypted.

This way you can decide yourself what data you want to keep confidential. If you want you can put everything in the AD, so you would not have any ciphertext, only plaintext and the authentication tag.

Usually you only need to provide a single key which can be used for both confidentiality and authenticity, simplifying key management somewhat.



Notes:


You may require additional constructs such as a message counter or session keys for each sending entity to create a secure protocol; just having a MAC or authenticated cipher may not be enough.
Most cryptographers agree that encrypt-then-MAC is more secure than MAC-then-encrypt in most situations, so please keep that in mind if you do need to keep part of the data confidential.
When in doubt: use HMAC; it's the most common MAC, it has aged really well and provides lots of security. HMAC-SHA-256 - HMAC with SHA-256 as underlying hash algorithm (configuration parameter) is a good, secure, generally available algorithm. If you think a 32 byte tag is a bit too large you can just the 16 leftmost bytes instead.