Answer
BLE uses pairing like classic BT. Data can be encrypted using AES (classic BT uses the SAFER+ algorithm) Link keys are still 128 bits long. AES is implemented by higher layers rather than in the baseband as in classic BT.
For more articles and definitions, see the Laird Knowledge Center.