Let F be a pseudorandom permutation. Consider the mode of operation in which a uniform value ctr 2 {0,1}n is chosen, and the ith ciphertext block ci is computed as ci := Fk(ctr + i + mi). Show that this scheme does not have indistinguishable encryptions in the presence of an eavesdropper. (problem 3.27 in the textbook)

Here are few hints:

Essentially F_k (ctr+ i + m) allows an adversary to do some "arithmetic" inside F_k

Can an adversary create a two messages m_0 and m_1 such that both cipher blocks for m_0 are the same and for m_1 are different? This will allow the adversary to win the indistinguishability game. I am assuming m_0 and m_1 have two blocks.