  Availability is crucial to the security of distributed systems, but
guaranteeing availability is hard, especially when participants in the system
may act maliciously. Quorum replication protocols provide both integrity and
availability: data and computation is replicated at multiple independent hosts,
and a quorum of these hosts must agree on the output of all operations applied
to the data. Unfortunately, these protocols have high overhead and can be
difficult to calibrate for a specific application's needs. Ideally, developers
could use high-level abstractions for consensus and replication to write
fault-tolerant code by that is secure by construction. This paper presents
Flow-Limited Authorization for Quorum Replication (FLAQR), a core calculus for
building distributed applications with heterogeneous quorum replication
protocols while enforcing end-to-end information security. Our type system
ensures that well-typed FLAQR programs cannot_fail_ (experience an
unrecoverable error) in ways that violate their type-level specifications. We
present noninterference theorems that characterize FLAQR's confidentiality,
integrity, and availability in the presence of consensus, replication, and
failures, as well as a liveness theorem for the class of majority quorum
protocols under a bounded number of faults.
