> the EVP_EncryptUpdate function has the option to pass data that is only > MAC'ed but not encrypted. Is there some similar provision in the BIO > interface? I have a use case, where I'd like to "inject" > pre-encrypted/pre-mac'ed data into a TLS stream. Any suggestion on a low- > effort way to do this? You mean you have an SSL BIO, and you want to avoid the SSL encryption/record-layer/etc for part of it? Not possible.