Talk about a death wish
1. Putting a Bulletproof Vest on the Naked Emperor
Have you forgotten how everyone got the maimai servers’ underwear off?
Here’s where things stand: the transport layer’s AES Key and IV are known to the whole world. ttnk knows, you know, every script kiddie on the street knows; all traffic is plaintext and transparent to an attacker
And what’s your brilliant plan? You suggest locking the UserID into a little password-protected Feistel box inside a transparent glass room
But
the attacker is holding the AES key, so he doesn’t need to crack your Feistel
He just needs to capture one legitimate packet, grab that 0xDEADBEEF you obfuscated, then construct a JSON:
{ "userId": "0xDEADBEEF", "score": 114514 } and encrypt it with the AES Key in his hand before sending it off
The server will obediently decrypt the AES, then reverse your quantum-encrypted ID back, and finally write the dirty data into the database
Apart from wasting server CPU on 10 rounds of SHA-256, you’ve defended against absolutely nothing
You didn’t even close the front door, but you installed a retinal scanner on the bedroom and taped the retina data to the living-room wall
2. Are You Trying to Make the Servers Explode at Midnight on Schedule?
“Use the current date… to generate a tweak… changes once a day.”
Did you laugh at yourself when you wrote that sentence?
Do you even know that maimai’s AimeDB and TitleServer are separate?
For example
A player connects to AimeDB at 23:59:59 and gets data encrypted with yesterday’s key
Then at 00:00:01 they connect to TitleServer, and the server has switched to today’s key
Then it blows up on the spot: decryption fails, or it decrypts into a completely unrelated ID, and a pile of garbage gets written straight into the database
Are you that eager for the servers to blow up faster, so you specifically designed a midnight bug? Doing this kind of strongly time-dependent key synchronization in a separated architecture — nobody but an AI that never considered context would dare design it. Off by even 1 millisecond, and the player’s data goes to the crematorium
3. Is the maimai Client a Python Script in Your Backyard?
“The cabinet side needs no decryption at all; it can directly… be used for requests.”
You think SEGA’s cabinet code is written in JS? var id = anything?
That’s a heap of shit running on Windows
That code most likely hardcodes int32, and probably has all sorts of assert(id > 0) checks too a guess — I haven’t reverse-engineered the app myself; experts are welcome to correct me
The result your Feistel algorithm produces is a pseudorandom number
- What if it’s negative?
- What if it overflows?
- What if it happens to hit a Debug ID reserved internally by the client?
The result is the cabinet crashing on the spot with 0010
You say “no changes needed” because you don’t understand strongly typed languages or legacy code at all. All you care about is whether the AI-generated code feels good; you don’t care whether the cabinet dies
4. The AI Stench Overflowing Off the Screen
master_key, tweak, PRF16, current_round…
That whole set of variable naming — bro, you didn’t change a single one
This is the standard textbook pseudocode it spat out at you after you typed “how do I design the world’s strongest encryption algorithm” into the ChatGPT box
You didn’t change a single character and pasted it straight into a letter to SEGA?
You’re treating the answers to the end-of-chapter exercises in Introduction to Modern Cryptography as an enterprise-grade solution?
If SEGA’s engineers saw this code, they’d probably think some kid who just started learning Python was having a meltdown
You can’t even be bothered to think for yourself when showing off; you rely entirely on GPT to ghostwrite for you
5. A Syrian Suicide Truck That Exposes Your Own Intelligence Level
Hijacking my 5G traffic? Injecting a CA certificate into my phone?
Have you watched The Matrix too many times?
That crappy py script from 开源科技 is the malicious client
Who has the spare time to hijack your crappy phone? The attacker just wrote a Python script, and with that hardcoded universal AES key in his hand, walked right in through maimai’s front door
HTTPS is there to stop a passerby from reading the contents of the letter; it is not there to stop the sender from poisoning the letter himself
You can’t even grasp this most basic endpoint security concept, and you still dare call yourself a “backend developer”? Which cesspit’s backend do you develop?
6. Can You Just Forget That Crappy “Feistel Algorithm” of Yours
Why does knowing the AES key and the IV = traffic is transparent
This is the dumbest joke I’ve heard in 26 years
So what you mean is, someone who calls himself a “Michelin chef” asks me why boiling water burns your hand?
The AES Key is leaked so badly it might as well be a public toilet; the transport layer is a transparent glass tube
And you’re still there doing Feistel encryption on the UserID inside it?
Does the attacker need to crack your Feistel? Does he even have to?
He just grabs a legitimate encrypted ID, stuffs it into a new JSON body full of garbage data, re-encrypts it with that public AES Key of yours, and sends it out
What happens when the server receives it? The server, like a fucking idiot, first decrypts the AES, then reverse-engineers your nonsensical Feistel, and finally happily writes the garbage data into the database
Apart from wasting the server’s CPU cycles, does this whole routine of yours serve any purpose whatsoever? You’re doing performance art with cryptographic algorithms
Anyone who understands even a little cryptography would never ask “why does knowing the symmetric key let you decrypt”
This only proves that everything you wrote about Feistel and HMAC is, ten thousand percent, garbage copied from an AI that you don’t understand at all
7. Admitting You’re Just GPT’s Mouthpiece
The algorithm was originally hand-written by me, later I used ChatGPT to change it because there were problems…”
Doesn’t saying that out loud embarrass you?
- “Hand-written had problems” -> proves you can’t even put together a basic cryptography wheel
- “Changed with ChatGPT” -> proves the core logic of this scheme was copied from an AI
- “Didn’t change the variable names” -> proves you can’t even copy properly; whatever shit the AI spat out, you serve right back up
You take a pile of garbage pseudocode copied from a textbook — code you can’t even run yourself — and treat it as a miracle cure for the world? If SEGA’s engineers saw this code, they’d put you straight on the hiring blacklist, because they know that hiring an idiot who can only make AI write code is more terrifying than the servers being attacked
Since you’re so eager to be shared, I’ll oblige: let everyone get to know this self-important idiot who can’t even understand the intro of Computer Networking: A Top-Down Approach. Feel free to point out any flaws in my technical critique — I’m happy to oblige
8. Conclusion
Bro, I really didn’t want to beat on you, but running around shoving your vibe-cooked product in everyone’s face is an insult to the vast majority of responsible computer science professionals
You’re just a script kiddie who picked up a key from a garbage heap, broke into a house and stole a few things, and then started fantasizing about teaching the homeowner how to renovate
Your scheme understands neither transport-layer security, nor distributed consistency, nor compatibility
Its only use is proving that, in 2025, AI still can’t cure human brain atrophy. Stop messing around in computer science; go turn screws — that doesn’t need logic, only muscle
Also, thanks to all the comrades who fought alongside me, thank you for your support and company all this way and for caring about the game’s environment. Wishing everyone a happy new year in advance~
