Following on from [this question](https://security.stackexchange.com/q/171356/17049), I am unclear on which of the following steps are sufficient to protect a WPA2-based wifi connection from the [KRACK](https://en.wikipedia.org/wiki/KRACK) flaw:

1. Patching the AP (e.g. router)
2. Patching the client (e.g. mobile device)
3. Patching the AP **and** the client

The currently most upvoted [answer](https://security.stackexchange.com/a/171358/17049), citing https://www.krackattacks.com states:

> Both clients and access points are listed in the paper as being
> vulnerable.

and:

> implementations can be patched in a backwards-compatible manner [...]
> To prevent the attack, users must update affected products as soon as
> security updates become available. [...] a patched client can still
> communicate with an unpatched access point, and vice versa.

But this seems to leave open the question of which combination(s) of patches would be an effective fix. It's clear for example that if I were to patch my phone, it would still be able to communicate with an unpatched AP, but would that communication be secure?

This is an important question, because while it is relatively easy to make sure my clients are patched once the patch is available (since the number of OS vendors are relatively small), ensuring all routers are patched (particularly in public wifi APs) seems like a much harder task.