I have a CBC-MAC scheme using AES as the block cipher (T=H_K1(M)), which gives me a tag and a stream cipher using another key and a nonce, which gives me a cryptotext (C=E_K2(N,M)). So my question is based on a known-plaintext attack to create a valid (ciphertext, nonce, tag)-tuple. I already figured out how I can create a new message to get the same tag with a given pair (M,T):
M1 = M xor T => T = H_K1(M) = H_K1(M||M1)
Then I already figured out that I can get the keystream of a given (message, nonce, ciphertext, tag)-tuple:
KS = M xor C
But now I don't get it, how I can create another valid (nonce, ciphertext, tag)-tuple with these information.
Thanks for any ideas in advance.