Workaround for CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, and CVE-2017-13081
Limiting the maximum number of Extensible Authentication Protocol (EAP) over LAN (EAPoL) key retries to 0 has been determined to be a valid workaround for these vulnerabilities. Setting the EAPoL retries value to 0 means one message will be sent, there will be no retransmissions sent, and if the EAPoL timeout is exceeded the client will be removed.

If EAPOL retries are disabled, it means that there will be no retransmissions and once the EAPOL timeout passes, the client will be removed. This does mean that authentication may be slower, depending on traffic (see earlier) or if you're using some embedded clients with particularly slow processing. These clients are likely to be older or lower power devices and thus may not be patched by their vendors for Krack, which leaves them vulnerable. If you are confident that all of your clients are patched for Krack and authentication is too slow then you can re-enable EAPOL retries to improve efficiency or allow access to clients who authenticate slowly.

hornbyp wrote: I have received client-side security patches for precisely none of them!