# Why does CTR mode become insecure after $2^{0.5 \times n}$ blocks?

The question is exactly what it says on the tin. If $n$ is the block size in bits of a block cipher, then why does outputting $2^{0.5 \times n}$ block in counter mode become a problem when there is no repetition of the keystream until after $2^{n}$ blocks have been output?

Now with respect to the bound you mention, if you give me $2^n$ blocks of zeros to encrypt and I give you back $2^n$ distinct blocks then you should feel confident I used CTR mode. After $2^{n/2}$ blocks of random values you have a good probability of having observed a duplicate if I am giving you random values.