Adam Bozanich Did Not Uncover An NSA IPsec Conspiracy: Diffie Hellman Parameter Validation Explained

introduction

Alice and Bob want to arrange a tryst. Bob’s wife Eve is sniffing their Instant Messenger traffic.

No problem! Alice and Bob will encrypt their messages with AES-256-CBC. Eve won’t be able to decode the traffic before the heat death of the universe.

One small problem: what AES key to use? Actually: not a small problem. No matter what key Alice comes up with, she can’t send it to Bob without exposing it. She can’t encrypt the key; chicken and egg.

number theory f.t.w.

There’s a solution to this problem. Alice and Bob will run the Diffie-Hellman protocol (DH) to securely exchange a key.

Alice and Bob agree on a prime number p, and a smaller number g with a special relationship with p ([1]). These are parameters to Diffie Hellman. “23” and “7” are valid p and g parameters. So are “37” and “5”. They aren’t secret. Think of them like a “version” of DH that Alice and Bob agree to use.

For the sake of argument, Alice and Bob agree on “37, 5” DH.

Bust out your calculator. I’ll be Bob.

Generate a random number a, modulo 37 (divide your number by 37 and a is the remainder).

I’ll do the same thing to generate a different b.

Now take your a and make A. Raise 5 to the a‘th power, modulo 37 (in Ruby, do “(5 ** a) % 37”. I’ll do the same with b to make B.

A is your public key. a is your private key. Send me A. I’ll send you B. It’s 29.

Take 29 and raise it to the a‘th power mod 37 (I don’t know what a is; it’s your private key, so I can’t tell you what you’ll get.) That’s “(B ** a) % 37” in Ruby. I’ll do the same with B.

We just arrived at the same number. Was your private key 7? We came up with 8. Was your private key 26? We came up with 27. 27 is our session key.

Funny thing about our session key: you know it, and I know it, but Eve can’t know it. Even though we did this computation out in the open. This is the deep magic, yo.

quick aside:

Well OK, Eve totally knows what number we came up with, because we used a ridiculously small p. Instead of 37, 5, try this:

FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF

Just use 2 as g. Remember now that your private key a is a random number modulo this huge p. It will also be huge.

Raising a number to a power modulo another number is modular exponentiation (modexp). A modexp is straightforward to compute.

The opposite of exponentiation is a logarithm. Taking a log mod another number is a discrete logarithm. Discrete logs are extremely hard to solve. With large enough numbers, “racing heat death of the universe” hard; “every atom in the Solar System is a computer trying to solve it, still unsolvable” hard.

So you have two closely related operations, exponentiation and logarithm mod p, one of which is easy to compute and one of which is hard. This is a cryptographic building block and the foundation of DH.

back to alice and bob

We got 26 for our session key. Let’s say we MD5 the text value of “26”, to get “4e732ced3463d06de0ca9a15b6153677”. Tack a “0x” at the front of that value, and we now have a 128 bit number we can use as an AES key. Eve can’t know we came up with 26, and so can’t know what the MD5 of the session key is, and so doesn’t know what our AES key is.

Problem solved! Cue arbitrary foreshadowing device. We’ll come back to this.

what adam bozanich found

Adam works for Mu Security. Mu is writing an IKE fuzzer. IKE is a key exchange protocol for IPSec. IKE is probably one of the worst protocols ever to come out of the IETF, and I’m not going to explain it.

What you need to know is that IKE generates the keys that secure dynamically-keyed IPSec tunnels (layer-3 VPNs), and that IKE uses DH to do that.

Adam remembers a DH gotcha. When Alice and Bob run DH, they have to be careful not to allow any of the parameters —- p, g, A, or B —- be zero or one mod p.

Why’s that? Bust out your 37, 5 DH math again. Alice’s session key computation is “(B ** a) % 37”. Bob sends B. If B is 1, the session key is… wait for it… 1. If B is 0, it’s 0. No matter what Alice’s private key is.

If Eve sees a public key that works out to 0 or 1 mod p, Eve knows what the session key was; it’s zero or one. Remember that there are infinitely many values that work out to 0 or 1 mod p. 0 is 0 mod 37. So is 37. So is 74. And so on. Bob could have sent any one of those bad public key values.

Alice and Bob are supposed to check for this. Adam looked at a bunch of IKE implementations. None of them did.

context

This is a well-known problem. It’s in Eric Rescorla’s DH RFC. It’s in an ANSI standard. You can’t use p - 1 mod p either. You also have to be careful with g; broken values will generate subgroups, not the entire group. And real DH implementations have optimizations that can be attacked mathematically if you’re not careful.

Just because it’s well known doesn’t mean people won’t make the mistake. That’s why Nate and I pointed the problem out last year (almost to the day!).

The general class of problems we’re talking about is parameter validation. You attack them by looking at the messages a protocol exchanges, and sending malicious bad values that will break the computation.

Are you a security researcher? Go look for some of these bugs. They rock. More in a sec.

but back to adam

So it’s interesting that IKE implementations don’t validate parameters, but it’s not particularly meaningful.

IKE Bob can send IKE Alice a bad public key. This key will cause Eve to know the session key Bob and Alice use. But why would Bob do this? He’s negating his own security!

Eve can try to inject a bad public key into the session. But so what? If Bob and Alice don’t agree on A and B, the public keys, they can’t run DH. Maybe a different attacker, Mallory, can get between Alice and Bob and proxy the messages. She’ll be a “man in the middle”.

In this case, Mallory wins. No matter what parameters you use and what bugs your code has, Mallory beats DH. This is a basic challenge with DH. The solution involves more crypto.

DH is a useful building block, but protocols that use DH usually depend on some other operation to ensure security. For instance, DH SSL uses RSA certificates to beat Mallory. DH is useful to SSL; it gives you perfect forward secrecy by not tying your SSL session key to a fixed RSA key that can be compromised. But DH SSL depends on RSA for security.

So it’s not a good sign that IKE implementations aren’t smart enough to do parameter validation. But it doesn’t make much of a difference. The “vulnerability” allows an IKE participant to elect an insecure session.

accident? or… murder!

Adam wants to take this somewhere. So he writes a blog post suggesting that the uniform weakness of IKE implementations could be evidence of a conspiracy.

I don’t think he’s being entirely serious, but here’s his argument: the NSA —- no wait, it’s 2007, let’s make it the RIAA —- demands the ability to snoop on everyone’s IPSec sessions. They get all the IKE vendors to ship backdoored IKE agents. On some secret signal, the IKE agent will send public keys that work out to 0 mod p, and the RIAA can break these sessions with the sniffers they’ve installed at every exchange point on the Internet.

There’s a reason this is silly besides the fact that it involves backdooring one of the least important security mechanisms on the Internet: it’s a dumb attack.

Mallory knows p and g. So does Seth, the secops guy. Mallory can watch for A and B values that are 0 mod p. So can Seth. Why would the RIAA install a secret backdoor you could write an IDS signature for?

There are much more subtle things you can do to backdoor DH. Start with, IKE implementations can just be backdoored with a known private key value, or a root backdoor private key and an algorithm for generating variants of it. Move on from there.

This isn’t a conspiracy. This is just ignorance.

and I know that because…?

Because this vulnerability happens all over the place.

Take SRP for example. SRP is a derivative of DH. Alice is a client, Bob is a server. Alice and Bob know Alice’s password. Alice generates a public key that is related to the SHA-1 hash of the password. Alice and Bob do a DH exchange to prove Alice knows the password, and if the exchange works, Alice wins.

Mallory sends Bob a public key of 0 mod p. Mallory wins. She can log in as Alice without knowing Alice’s password.

This vulnerability is well known. It’s in the RFC for SRP. But I’ve tested SRP implementations written by smart security people, and they’ve had this vulnerability. (Due credit: I got this trick from Trevor Perrin, via Nate Lawson).

Compare the SRP vulnerability to the DH vulnerability. The SRP parameter validation problem is really, really bad. It’s auth bypass. The DH vulnerability is just a dumb way to backdoor an IKE agent.

well played, adam

IKE is a mess of a protocol. Crypto parameter validation attacks are totally underappreciated. Adam’s blog post is cool. It was smart of him to check for this, and interesting that he found it.

and what have we learned?

Not much about IKE. It’s as secure as you thought it was before you heard about Adam’s finding.

Hopefully a lot about crypto, though. Like I said, we wrote a post last year talking about parameter validation tricks for DH, SRP, Elliptic Curve, and RSA.

Forget about algorithmic attacks and advances in factorization and quantum computers. Parameter validation attacks are a systems flaw; systems depend on code, and code is riddled with bugs. All bugs are vulnerabilities. Most… any? cryptosystems will be beaten by stupid bugs like this.

Go look for them!

---

[1]: g is a primitive root modulo p. For values of x from 0 to p - 1, raise g to x modulo p. If g is a primitive root modulo p, you’ll end up with every number between 1 and p - 1, in some order. For instance, the following Ruby snippet asks if 3 is a primitive root mod 37.

lst = [] ; 0.upto(36) {|d| lst << ((3 \*\* d) % 37)} ; lst.sort

elicits the following output:

[1, 1, 1, 3, 3, 4, 4, 7, 7, 9, 9, 10, 10, 11, 11, 
 12, 12, 16, 16, 21, 21, 25, 25, 26, 26, 27, 27, 28, 
 28, 30, 30, 33, 33, 34, 34, 36, 36]

2’s missing. So’s 5 and 6, etc. 3 is not a primitive root mod 37. Now try 5:

lst = [] ; 0.upto(36) {|d| lst << ((3 ** d) % 37)} ; lst.sort

[1, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 
 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 
 29, 30, 31, 32, 33, 34, 35, 36]

All the numbers between 1 and 36 are there. 5 is primitive root mod 37.

Why is this important? Because if you’re working with a 1024 bit prime, you want session key values to possibly be any one of those 1024 bit values. Another word for “primitive root” is generator. Generators generate the entire group of values mod p. Bad values of g generate subgroups, with fewer than 1024 bits of possible values. The worst g values generate only two possible values!

Comments

[Dave]

Are you sure that second expression is going to test whether 5 is a generator? :-).

[Jennie]

Although quite some time, I consider this a complete info worth the read although it sounds too technical but the issue has been well said with matching "conversation like" explanation. The main point here is the word Security in all aspects of your dealing. valentines day gifts delivered

[Borderline_ADD]

The IPsec working group had a simple and clean key exchange protocol called Photuris written by two brilliant people with a history of writing bulletproof protocols and RFCs. But the leadership of the WG had a personal issue with one of the authors, and the WG scrapped Photuris. They then put together a far less experienced team (in terms of protocol authorship, that is) that developed and rammed through the ball of warts we now call IKE.

Committee-think at its best.

[louis vuitton]

lv owners, please listen up. I am spotting a lot of louis vuitton out there that are being misused and mishandled. These precious Louis vuitton bags should be handled like newborn babies. With a gentle touch and lots of love. louis vuitton handbags are some of the most luxurious of all handbags. You have to appreciate the hard work and craftsmanship put into each Louis item.

[collections dvd]

Free download iCoolsoft PPERFECT STRANGERS
to 3GP Converter and easily enjoy PPERFECT STRANGERS DVD
movies with your mobile phone on the go. The PERFECT STRANGERS DVD COLLECTION mailing list is a good source for further information.

And if you accept a replica Chanel handbags
on your arm again you will be able-bodied accepted. Chanel is accepted for abundant Chanel handbag
, however if we were to name the face of Chanel again it would be the Chanel archetypal Chanel
.

[collections dvd]

It can also rip and convert RHODA
movies to 3G2, MPEG-4, H.264. ICoolsoft RHODA DVD
to 3GP Converter enables you to customize all video/audio encoding settings like Video Encoder.The image directory eventually will hold the completed RHODA DVD COLLECTION
.

Chanel Wallet
are fabricated actual well. China is a cogent architect of affected and Chanel handbags
. Out of all of the replica Chanel handbags that are accessible on the bazaar now.

[collections dvd]

It can also rip and convert RHODA
movies to 3G2, MPEG-4, H.264. ICoolsoft RHODA DVD
to 3GP Converter enables you to customize all video/audio encoding settings like Video Encoder.The image directory eventually will hold the completed RHODA DVD COLLECTION
.

Chanel Wallet
are fabricated actual well. China is a cogent architect of affected and Chanel handbags
. Out of all of the replica Chanel handbags that are accessible on the bazaar now.

[liuhan]

Microsoft MCITP practice exams are just the MCSE beginning. With each exam you will see real Microsoft MCITP practice questions giving you the ultimate Microsoft MCITP MCSE Exam preparation available online anywhere. Where else can you find an Microsoft MCITP study pack with so many MCSE Exam possibilities? 70-620 Exam

[Hampers]

Just gone through your blog and found it wonderful. It was nice going through your blog. keep on posting.

[ed hardyswimwear uk]

ed hardy hoodies
cheap christian audigier bikini
ed hardy shirts
cheap christian audigier hoody
women ed hardy clothing
ed hardy hoody uk
ed hardy jacket
ed hardy uk
ed hardy shirts
ed hardy swimwear
ed hardy ugg boots
ed hardy shoes uk
ed hardy hoody uk
buy ed hardy shirts
ed hardy womens shoes
ed hardy handbags uk
ed hardy at uk
ed hardy t shirts uk
ed hardy sunglasses uk
ed hardy womens tiger hoodie

[Hampers]

Just gone through your blog and found it wonderful. It was nice going through your blog,

[ED Hardy Belts]

Nike Rifts
Nike Rift
nike air max
nike air rift
nike air rifts
nike rifts men
nike air max skyline
nike air max classic
nike shox rivalry
air max 90
nike air max 90
Air Max Skyline
Nike Dunk Sb
Nike Free Run+ Men
Nike Air Rift Women
Nike Shox
Nike Kid Shoes
Nike Air Max 1
Nike Air Max 87
Nike Air Max 180
Nike Air Max 2003
Nike Air Max 2009
Nike Air Max 93
Nike Air Max 95
Nike Air Max 97
Nike Air Max Classic Bw
Nike Air Max Light
Nike Air Max 88
Nike Air Max Ltd
Nike Air Max Tn
Nike Air Rift Men
Nike Air Max 90 Kids
Nike Air Max TN Kid
Nike Air Rift Kid
Nike Shox R4 Kid
Nike Shox NZ
Nike Shox OZ
Nike Shox R4
Nike Shox Rivalry R3
Nike Shox TL
Nike Shox TL3

nike rifts
nike rift
nike air max
nike air rift
nike air rifts
nike air force
nike air jordan
nike shox
nike shox rivalry
air max 90
nike air max 90
Nike Air Rejuven8
Nike pas cher
Rift Nike
Nike Air Max Skyline
Air Max Skyline
Nike Rifts Men

Nike Rifts
Nike Rift
Nike Air Max
Nike Air Rift
Nike Air Rifts
Nike Air Force
Nike Shox OZ
Nike Shox R4
Nike Shox Rivalry
Air Max 90
Nike Air Max 90
Nike Air Rejuven8
Nike pas cher
Nike Air Rift Femme
Nike Air Max Skyline
Air Max Skyline
Nike Air Rift Homme

ED Hardy
ED Hardy Clothing
Christian Audigier
ED Hardy Accessories
ED Hardy Bags
ED Hardy Handbags
ED Hardy Belts
ED Hardy Sunglasses
ED Hardy Kid's T-shirt
ED Hardy Kid Shirt
ED Hardy Kid
ED Hardy Man
ED Hardy Active Wear
ED Hardy Man Wear
ED Hardy Hoodies
ED Hardy Outerwear
ED Hhardy Man's Hoodies
ED Hardy Long Sleeves
ED Hardy Man's Sleeves
ED Hardy Shoes
ED Hardy Man's Shoes
ED Hardy T-shirts
ED Hardy Man's T-shirts
ED Hardy Swim Trunks
ED Hardy Man's Trunks
ED Hardy Women
ED Hardy Bottoms
ED Hardy Women's Bottoms
ED Hardy Women's Hoodies
ED Hardy Women's Outerwear
ED Hardy Intimates
ED Hardy Lingerie
ED Hardy Women's Sleeves
ED Hardy Sandals
ED Hardy Women's Sandals
ED Hardy Women's T-shirts
ED Hardy Swimwear
ED Hardy Bikini
ED Hardy Tanks
ED Hardy Women's Tanks
ED Hardy Knits Tops
C A Women
C A Man

[Christian Louboutin]

Christian Louboutin On Sale Market sales Christian Louboutin has boutiques in Paris, United States, London, England, Australia. In Asia, the first Christian Louboutin Boots boutique was opened in October 2007 on On Lan Street in Central, Hong Kong.The red outsole is the distinctive features of?Christian Louboutin Flats , also is the female of gentle, lovely, beautiful and sexy logo.And you've found the world's most comfortable Christian Louboutin Sandals,just from here.In the 1980s,Moncler Kid's become unprecedentedly popular all over the world.Yes, that isMoncler.In fact, after 50 years development,Moncler has already become an international brand together with LV, Channel, Gucci and other famous brand.Today, owning aMoncler Jackets Vest is numerous Youngman's dream. Imaging one person wears a Moncler Accessories,he or she will become the focus of attention.No matter what kind of dress you like, you can have a look atHerve Leger bandage dress.Ladies who love beauty may choose Herve Leger bandage dress, you will find what you are looking for is in 2010 new style Herve Leger Strapless. There have a chance for you to shop on 2010 new styleHerve Leger Strapless sale online store, to catch the fashion wind.Hermes handbags is one of the best handbag brands in the world. For more than 100 years,Hermes birkin makes its handbag by the traditional European technology of handicraft, which is also a platform for many craftsmen to realize their dream.Hermes Kelly knows the principle that less is more, so although HERMES Kelly 22CM Bags is a century for mass production,HERMES PURSE keeps on its traditional manufacturing system, which helpsHermes Purse and Other rank high among the worldwide famous brands.?

[case]

However mean your wow goldlife is，meet it and live it ;do not shun world of warcraft goldit and call it hard names.It is not so bad as you are.It wow goldlooks poorest when you are richest.The fault-finder will find faults in paradise.world of warcraft goldLove your life，poor as it is.You may perhaps have some wow goldpleasant，thrilling，glorious hourss，even in a poor-house.The world of warcraft goldsetting sun is reflected From the windows of the alms-house as brightly as From buy wow goldthe rich man’s abode;the snow melts before its door as early in the spring.I do not see but a quiet mind may live as gold wowcontentedly there，and have as cheering thoughts，as in a world of warcraft goldpalace.The town’s poor seem to me often to live the most independent lives of any.May be they are simply great enough to receive without misgiving.Most think that they are above being supported by the town;but it often happens that they are not above supporting themselves by dishonest means.which should be more disreputable.Cultivate wow goldpoverty like a garden herb，like sage.Do not trouble yourself much to get new things，whether clothes or friends，Turn the old，return to them.Things do not change;we change.Sell your clothes and keep your thoughts.

[case]

It hurts to love diablo 2 cd keysomeone and not Warcraft 3 CD Keysbe loved in returnStarcraft CD Key. But what is morewow gold painful is to love cheap wowgoldsomeone and neverbuy wow gold find the courage wow gold cheapto let that personworld of warcraft gold know how you powerlevel wowfeel.A sad thingWow gold in life is when world of warcraft goldyou meet someone who wow pomeans a lot to wow oryou，only to findWow gold out in the end wow orothat it was never wow goldmeant to be and wow soldiyou just have wow oroto let go.The wow goldbest kind of wow orofriend is thewow gold kind you can sit wow gold cheapon a porch swing wow orwith，never say a wow goldword，and then walk wow soldiaway feeling like wow gold pas cherit was the best wow gold frconversation you've po wowever had.It's true wow gold kaufenthat we don't know what eq2 platwe've got until we lose eve online iskit, but it's also true Final Fantasy XI gilthat we don't know what we've been ffxi gilmissing until it arrives.It wow goldtakes only a minute to wow goldget a crush on someone，world of warcraft goldan hour to like someone，and wow power levelinga day to love someone- wow pobut it takes a lifetime to forget wow orsomeone.Don't go for looks；world of warcraft goldthey can deceive. Don't go for wow powerlevelingwealth；even that fades away. Go buy wow goldfor someone who makes you smile because it takes only a smile to make a wow gelddark day seem bright.Dream what you want to dream；go where wow goldyou want to go；be what you want to be，because you have only one world of warcraft goldlife and one chance to do all the things you want to do.Always put yourself in the other's shoes. If wow powerlevelingyou feel that it hurts you，it probably hurts the person too.A world of warcraft goldcareless word may kindle strife；a cruel word may wreck a life；a timely word may level stress；a loving word may heal and wow powerlevelingbless.The happiest of people don't necessarily have the best of everything they just make the most of everything that comes along their way.Love begins with a smile，grows cheapest wow goldwith a kiss，ends with a tear. When you were born，you were crying and everyone around you was smiling. Live your life so that when you die，you're the one smiling and Wow Goldeveryone around you is crying.

[case]

In your work, ffxi cheap gilyou have to let everquest2 platinumpeople see Ffxi gilthat you've always 110% effort wow goldat work. If eq2 goldyou want to wow gold kaufenwork on outstanding, and that buy wow goldpositive points, do not wow pofall by the waysidewow power leveling. Commitment wow orto our work wow poand ecognize your wow orown strengths. Everyone wow goldhas their own World of Warcraft Goldstrengths. Spare time Buy WoW Goldto spend the cheapest wow goldeffort necessary to wow goldlook at ourselves World of Warcraft Goldto see what advantages Buy WoW Goldthey have, every wow oroday and strive to wow golddevelop its own buy wow goldmerits. Maintain a wow oropositive work attitudeworld of warcraft Gold, when you go into wow goldthe office, so world of warcraft goldthat we are willing wow geldto fight around youcheap wow gold. When your boss wow gold kaufento see you at wow goldwork so prominentwow gold kaufen, so what they seemwow geld, and also so activewow gold cheap, enthusiastic, and World Of Warcraft Goldthey can not help cheap wow goldbut find that peoplebuy wow gold around you are wow geldlaunched up. Buy WoW GoldBecause the peopleBuy maple story mesos around you will MapleStory Mesoslearn your strengths,City of heroes gold and want to COH influencedo better than City of Villainsyou. This is COV infamyindeed a kind Buy ffxi gilof chain reactionFFXI gil. Therefore, in orderRS Gold to impress their Runescape moneysuperiors, your firstAge of conan gold step is to work Age conan goldon your passion, threwbuy aion gold yourself into Silkroad online goldwork every gold aionday. So justSilkroad buy be positive in Silkroad goldyour work.

[case]

The integrity of runescape goldlife is to know runescape moneyhow to face his EverQuest 2 golddefects, how bravelyeq2 plat rejecting those fantasies dofus kamaswithout this shortcomingkamas dofus. The integrity of cheap kamaslife is a man or kamas shopa woman to know this: dofus kamashe (she) find themselves kamas dofusable to face life buy kamastragedy and continue acheter kamasto live after the loss dofus kamasto still show a kamas dofuscomplete person. Lifeacheter kamas is not a God cheap kamasto condemn us forrunescape minigame failing to trap us.rs2 gold Life is not a spelling rs minigamebee. No matter how rs itemsmany words you spellcheap rs gold, if there was arunescape2 money mistake, you will comers mini game to naught. Life is rs2 moneymore like a baseball buy rs goldseason. Even the best Runescape Equipmentteams in the competition dofus kamaswill lose 1/3, and kamas dofusthe worst team alsobuy kamas has the best moments kamas dofusof the day. Our goal is dofus kamasto win, I lose lessDofus 2.0 Kamas. We accept that no Ffxi Gil integrity is part of dofusbuyhuman nature, we continually cheap ffxi gilscroll of life and realizedofusbuy its value, we will completebuy ffxi gil the full process sale ffxi gilof life. For dofusbuyothers, it can only bebuy ffxi gil cheap a dream. I believe thatffxi gil this is God on our Aion Gold requirements: not for runescape power leveling
the "perfectt " ;Aion power levelingmistake " and be "cheap aion goldcomplete". If we are brave Dofus 2.0 Kamasenough to love, strong ability to go to tolerance, generous enough to share the happiness of others, wise enough to understand the side is full of love, then we can get other organisms cannot be Dofus 2.0 Kamas
achieved.(there may be some mistakes because of some reasons, please forgive it.)

[melinzero]

Quality Wholesale replica watches, Swiss replica franck muller and More ，you can find huge selection of replica daniel roth, Cheap replica gerald genta, Rolex replica watches, Our Replica Rado /imitation watches include Fake Rolex replica ebel Rolex, Cartier, and many more. These replica watches are amazing substitutes for the original timepiece of replica glashutte., All Replica Roger Dubuis from us are at wholesale price but great quality. Longines most replica watches well recognised luxury replica watch watch range is the replica seiko Dolce Vita for women with its elegant replica cartier rectangular watch case replica swiss legend in a choice of For a luxury replica watches watch to be able replica watch to be stamped as replica technomarine "Swiss made", watch manufacturers replica chanel must comply with certain replica stuhrling legal requirements, for Links of London example, at least 50% Links London of the watch parts must links london store be made in Switzerland and links london 2010 NEW ARRIVALS the assembly and final links london Bracelets testing of the Replica Cartier 21 Must De Cartier Watches movement must

[qiao456]

with the unique look and design, vibram five fingers may give you a big surprise when you see five fingers shoes at the first time.However, vibram five fingers shoes are very comfortable when you are running or doing some sports,and they can keep your feet in good shape and healthy.vibram kso provides a series of five fingers kso and vibram five fingers in fashion design and good quality. In the modern time, five fingers shoes are accepted by more and more people and you can get your favorite ones from vibram five fingers shoes Sale. Feet are very important to our health; please choose the best footwear to care for them. So choose vibram kso for your feet good care. we believe that your online shopping five fingers kso experience should be convenient, fun, and most of all, safe. While browsing our web vibram five fingers store, you can rest assured that we have your security in mind. five fingers shoes and vibram five fingers shoes on our site. Enjoy free shipping and save over 50% off. vibram kso new releases,excellent quality and low price allows you to rest assured to buy. five fingers kso products include Vibram Five Fingers kso trek,moc,performa etc.

[Puma snerkers]

PUMA sneakers Usain terus mendorong sampai batas kecepatan dan kekuatan, dengan gayanya yang unik dan penuh kegembiraan. Banyak energi dicurahkan dalam penciptaan sepatu PUMA YAAM yang ia ukir di jalur. Jelas, kami telah menemukan rumus yang tepat bagi sepatu juara. Kami bergairah karena memiliki Usain sebagai bagian dari keluarga PUMA kami dan mengucapkan selamat atas kemenangannya sebagai juara dan rekar baru dunianya," kata Zeitz.PUMA shoes on sale
"Kegembiran yang mengelilingi loma ini tak ada bandingannya dan komptisi ini sama kerasnya seperti yang sudah-sudah," kata Jochen Zeitz, CEO dan Ketua PUMA AG. "Setiap orang berada pada puncak kondisi mereka. Tetapi melihat Usain menerangi jalur lomba seperti yang dulu dilakukannya dan tampil dengan finish 9:58 detik, memecahkan rekornya sendiri ... itu adalah saat yang akan hidup sepanjang jaman.PUMA shoes online store

[bella]

Support by UK shopping juicy couture necklaces earrings was intuitive and nowadays we have matured internationally with stores in 1990.cheap juicy couture he party resulted from a clean exact for her wife, juicy couture watch john Ayton,founded the jewelry mark,juicy couture necklaces sale cheap juicy couture.Relations of London were founded in the UK,Hong Kong, juicy couture watch charms USA and Canada. links of london charms charms links london is one of the chief jewelry brands in the United Kingdom links of london bracelets store offers kinds of elegant jewelries for wholesale and retail.Wearing links of london charms jewelry makes you out of ordinary in a crowd.Importantly, the more you buy,the more the discount you get from links london.Are you looking for discount prices on links of london bracelets Flip Flop Charm?Cheap links of london charms and best service is the shortcut for you to the high-quality life.Don't hesitate! links london is your best choice! links of london bracelets are proud to present a limited edition especially for Valentine's to our popular collection.Featuring a heart shaped it look more and more fashion for links of london charms.the more you buy,the more the discount you get from links london.Wearing amazing links of london bracelets Necklaces is the most popular way for women to draw people’s attention because links of london charms reveals woman’s inner beauty and personal taste.Hurry up please!Go shopping for links london Necklaces.This links of london bracelets silver necklace is not only a classic one but a masterwork.links of london charms Store makes sure that the three-dimensional and hollowing heart can bring more admiring eye on you. links london is your best choice! Silver chain,many silver rings and a heart-shaped pendant, links of london bracelets merge all these elements together in the Sweetie Chain Necklace.links of london Store carefully selects this links london sweetie necklace for noble temperament.The links of london bracelets sweetie chain necklace of a few signature sterling silver rings,provided by Links London Store.

[Nike Basketball Shoes]

the Nike Air Force 1 has grown to the shoe while the high-top's bind is mutable and removable. NBA players Rasheed Wallace and Jerry Stackhouse have been created air jordan retro 6,Nike Basketball Shoes,Nike Air Yeezy,air jordan retro 7,air jordan retro 12

[duo duo]

New model [url=http://www.brandwatches4u.com/]oris watches[/url] in stock, [url=http://www.brandwatches4u.com/]oris[/url] Up to 50% off. Free 2-day FedEx.
Get [url=http://www.worldwatchesbrand.com/]iwc watches[/url] Great Deals on Best Watches Now Authentic [url=http://www.worldwatchesbrand.com/]IWC[/url] Here.
[hr]
Get 100% Authentic [url=http://www.luxury-lvhandbags.com/]lv bags[/url]! Start Saving. Join Our Auctions Now
50-75% off [url=http://www.luxury-lvhandbags.com/]louis vuitton bags[/url] Premium brands. On sale now.
Wear the Latest Styles for [url=http://www.louisvuittonstore4u.com/]louis vuitton[/url] Find the Right [url=http://www.louisvuittonstore4u.com/]louis vuitton shoes[/url].
Luxury Louis Vuitton and [url=http://www.luxurylouisvuitton4bag.com/]louis vuitton bags[/url] 2010 Lastest Styles, hurry!
Free Ground Shipping on orders [url=http://www.luxurylouisvuitton4bag.com/]louis vuitton[/url] over $150. Place your order Now!
Get New [url=http://www.discountdesirebag.com/]discount louis vuitton[/url] for the Season with [url=http://www.discountdesirebag.com/]louis vuitton handbags[/url] from Top Brands.
100s of [url=http://www.discountdesirebag.com/]louis vuitton shoes[/url] Top Brands at Low Prices
Handbag Blowout Sale, Up to 70% Off 250+ [url=http://www.discountdesirebag.com/]discount louis vuitton handbags[/url] Handbag Brands. Free Shipping!
[hr]
The new [url=http://www.yeschanelgift.com/]chanel[/url] a professional [url=http://www.yeschanelgift.com/]chanel handbags[/url] diving table, [url=http://www.yeschanelgift.com/]chanel bags[/url] dedicated to leading the wave of luxury sports men and women.
[hr]

[duo duo]

New model oris watches in stock, oris Up to 50% off. Free 2-day FedEx.
Get iwc watches Great Deals on Best Watches Now Authentic IWC Here.
<hr />
Get 100% Authentic lv bags! Start Saving. Join Our Auctions Now
50-75% off louis vuitton bags Premium brands. On sale now.
Wear the Latest Styles for louis vuitton Find the Right louis vuitton shoes.
Luxury Louis Vuitton and louis vuitton bags 2010 Lastest Styles, hurry!
Free Ground Shipping on orders louis vuitton over $150. Place your order Now!
Get New discount louis vuitton for the Season with louis vuitton handbags from Top Brands.
100s of louis vuitton shoes Top Brands at Low Prices
Handbag Blowout Sale, Up to 70% Off 250+ discount louis vuitton handbags Handbag Brands. Free Shipping!
<hr />
The new chanel a professional chanel handbags diving table, chanel bags dedicated to leading the wave of luxury sports men and women.
<hr />

[sasas]

Whatever the reason, you can not abjure these ugg boots are accepted a allotment of barter of all ages. These ugg usually are awash at big-ticket prices, but there are places area you can get them at a amount that will accomplish added humans envious, such as internet shops, online auctions. uggs are accessible at both ample and baby stores.There are internet retailers alms these UGG Ultra Short Boots of poor superior at the amount of accurate pairs.