KRACK - Is all-zero key installed by the acces point? I don't really understand (and I think it's not described in the official paper) how the encryption can work when the encryption key is set to 0 by a KRACK attack on a device using wpa_supplicant 2.4 or 2.5.

Does the access point have to install this all-zero key? how to force this installation?
No, only one side installs the all-zero key. Which side depends on the mode being attacked (the client in standard 4WHS, the server in FT). Generally, the KRACK attack allows the adversary to replay, decrypt, or forge packets in a specific communication direction. 

Let's focus on the standard 4WHS here, as that corresponds to the case of your question. 
Here, the client will install the all-zero key, while the AP will install the correct (and unknown to the adversary) encryption key derived from the 4WHS. 
Thus, the adversary will be able to decrypt messages going from the client to the AP, but not the other way around. It will also be able to replay and forge messages towards the client (but not the AP).