Assuming by "signed" they mean cryptographically signed, and they're not doing something dumb, then the signature itself would be at least 16 bytes. It'd be ~impossible for a collision to ever occur by accident.

So either "signed" means something different in this context or GameFreak replicated Roku's reboot packet for some reason.

> then the signature itself would be at least 16 bytes.

Indeed, and 16-bytes is SHA1 or MD5, both considered insecure at this point. 32-bytes (SHA256) seems more likely to me.

So I'm going to bet that they aren't "signing" the packet.

AES-128 is also 16 bytes (128 bits), which is still (and likely will be for many, many years) completely secure, for all intents and purposes.

(SHA1 is 20 bytes, BTW.)

AES-128 is encryption, not a hash. AES-128 will be broken when computers get enough compute power to calculate 2^127 keys (the brute force attack: after covering 50% of the keyspace).

Cryptographic hashes are prone to the birthday attack instead. MD5 hashes (128-bits) are broken when a computer has enough power to calculate 2^64 keys (birthday attack: they found a hash collision).

SHA-1 is 20 bytes.