In short: with AES encryption can an attacker create a new key2 and plaintext2 so that AESkey1(plaintext1) = AESkey2(plaintext2)
If so, can it be solved by just applying for instance a MAC like AES-GCM or an AES-CTR with a SHA256 HMAC?
Intended application: The encryption of a file. Every client having the key can decrypt the file. The encrypted file is handled blindly by a server (without knowing the key) by its SHA256 hash. When a new client is handed over a false key with the hosted file, he should be able to detect it is the wrong key. And not getting any other (noisy) binary from the same encrypted file as a result. Noting that an attacker delivering the false key has access to the original key, the ciphertext and thus also the plaintext.
(The option of identical files being encrypted with different keys should be there. So deterministic encryption is not my intention)
An other possible easy solution I thought of would be to store the hash of the secret key together with the encrypted file on the server and send it to the client to verify. But I actually prefer using a well known out-of-the-box solution, and not something I came up with. Is applying a MAC / HMAC enough to guarantee only one key results in the given ciphertext.
Hope my intention is clear, and someone knowledgeable can point me in the right direction.