Is Bluetooth Low Energy (BLE)'s link-layer encryption secure against an attacker who eavesdrops on some random BLE connection between two devices, but has not eavesdropped on the first connection between the two devices?
Background: When the two devices are initially paired, they derive a long-term key using a key-exchange protocol. Anyone who can eavesdrop on that initial pairing can learn the long-term key, but for purposes of this question, assume the adversary didn't eavesdrop on that initial pairing (e.g., because the adversary wasn't nearby). The two devices then use this long-term key to encrypt data sent on all future connections. BLE uses AES-CCM for link-layer encryption, which should be secure if the long-term key is unpredictable.
However, at WOOT 2013, Mark Ryan published a paper speculating about a possible attack against BLE. In his attack, the attacker injects a forged LL_REJECT_IND message to one device. Apparently, this will cause the recipient to forget the current long-term key and force a new key exchange to derive a new long-term key. The attacker can eavesdrop on this new key exchange, learn the new long-term key, and decrypt all subsequent traffic. At least, that's what Ryan speculated.
Does this attack actually work? Is BLE's link-layer encryption insecure, even if the attacker didn't capture the initial pairing between the two devices?
Reference: Mike Ryan, "Bluetooth: With Low Energy comes Low Security", WOOT 2013. https://www.usenix.org/conference/woot13/workshop-program/presentation/Ryan