Does only having one end of a wifi connection patched reduce the risks from KRACK?

Question

From the official FAQ on the vulnerability (emphasis mine):

So again, update all your devices once security updates are available. Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks!

Does this mean that a subset of the collection of attacks discovered can be prevented even if only 1 end of the connection has been repaired?

This image from Arstechnica, apparently a screen capture from the initial presentation, shows various platform implementations being subject to different KRACK attacks. This implies that at least part of the problem can be fixed from only the client side.

It's not clear what, or how much, client side only fixes can address. Do these represent 6 different ways to do the same attack? 6 different ways to tamper with a compromised connection? Something else? A combination of the previous?

Answer 1

TL;TR: It is often (but not always) enough to properly patch the WiFi client. You need to patch the AP to if it provides client functionality (i.e. router) or has fast roaming (802.11r) enabled.

From my understanding it is essential for all the attacks that the client accepts message 3 of the 4-way handshake again and then reinstalls the same encryption key and resets nonce and replay protection.
This means if the client is patched to not accept a message 3 which contains the same key as already installed it will not reinstall the key and not reset nonce and replay protection. This should be sufficient to thwart the attack, no matter if the server is patched or not.

Also, directly taken from the https://www.krackattacks.com:

What if there are no security updates for my router?

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.

Note that you could in theory also patch the AP to not retransmit message 3 of the handshake in case it did not receive message 4. This can be helpful in cases where patching the client is impossible.