Daniel J. Bernstein proposes an alternative to NIST AES-CTR based deterministic random number generator (AES-CTR-DRBG). Instead of a less performant complex construction, he uses an standard AES-CRT with a fast key erasure method.
I am asking myself, is AES key expansion overhead really necessary for this application?
Instead of using the the first 2 blocks of each 48 to generate a new key using the standard key expansion to generate the needed 15 round keys, use directly the first 15 blocks as round keys, bypassing completely the key expansion step.
Is this scheme less secure than the initial proposal of Daniel J. Bernstein?