With AES encryption and a known key and plaintext, can an attacker create a different key and plaintext resulting in the same ciphertext?
For basic AES, it is easy to find two keys in this way. Take any $key1$ and $plaintext1$ and compute $c=AES_{key1}(plaintext1)$. Then, take any $key2$ and compute $plaintext2 = AES^{-1}_{key2}(c)$. It follows that $AES_{key1}(plaintext1) = AES_{key2}(plaintext2)$. Having said this, if AES is used in an authenticated encryption mode with a MAC, this may not necessarily be possible. I wish to stress that there is no guarantee that not, and such a thing would need to be proven. In particular, if you did the standard encrypt-then-MAC (with different keys), then this would be vulnerable in exactly the same way, since the &quot;encryption&quot; part is unchanged. Bottom line, this should be possible to achieve, but it's certainly not guaranteed, and often doesn't hold at all.