I'm trying to create an birthday attack, but I can't seem to get through it as I've never done it before. The basis: We have $E_K$, an encryption function, which has $N$ possible keys $K$, $N$ possible plaintexts, and $N$ possible ciphertexts. Sadly, the Encryption function would make it easy to find the decryption function if the key was known. So, this isn't public. Next, For each pair of keys ($K_1$, $K_2$) we could find a third, $K_3$ such that $E_{K_1}(E_{K_2}(m)) = E_{K_3}(m)$ for all plaintexts, $m$. Generally, for every plaintext-ciphertext pair $(m,c)$, we'll have only one key $K$ such that $E_K(m) = c$. Now, assuming we know a plaintext-ciphertext pair $(m,c)$ how would I go about performing a birthday attack that finds the key $K$ in approximately $2*\sqrt{N}$ steps?
It's compelling me, but I'm unable to scratch the surface.