Difference between one-level and two-level E0 encryption I am trying to understand the practical security implications of the way E0 is used in Bluetooth 2.1 devices. In reading up on the subject, I am seeing that encrypting a large amount of data with E0 when using a single key gives way to practical attacks. Only so-called one-level E0 is vulnerable to this attack. Two-level E0 somehow uses a different encryption key for each frame (with a frame being 2745 bits long), and attacks against two-level E0 require the first few bits of a large number of frames. In order to understand the implications of E0's weakness as used in Bluetooth 2.1, I need to understand the difference between one-level and two-level E0. I have two questions:


Is one-level encryption the act of using a single master key and encrypting all Bluetooth frames with it, and two-level encryption is using a single E0 keystream with a master key to generate temporary per-frame E0 encryption keys?
Does Bluetooth 2.1, which uses HMAC-SHA-256 for key generation, still use two-level encryption? If so, is a master E0 keystream used for generating each E0 frame key, or is HMAC-SHA-256 used instead, making it so the attacks against two-level encryption do not apply to E0 as used by Bluetooth 2.1?
I seem to have found the answers myself:


Two-level E0 uses one instance of the cipher with the master key to generate the internal state for a second instance of the cipher which is then used to encrypt a single frame. I found this out from a slide presentation and a paper describing attacks against two-level E0.
Bluetooth 2.1 does still use two-level E0. HMAC-SHA-256 is only used in combination with P-192 key exchange to derive the master key. Attacks against two-level E0 do apply to 2.1, however the best known attacks require more frames encrypted under a single key than is supported by the protocol. This was made clear in a Security SE answer.