Why does the EdDSA use a 2b-bit hash function?

The EdDSA signature of a message $$M$$ under key $$k$$ is created as:

1. Define $$r=H(h_b,....,h_{2b−1},M)\in\{0,1,...,2^{2b}−1\}$$.

2. Define $$R=rB$$.

3. Define $$S=(r+H(\underline R,\underline A,M)s)\bmod\ell$$.

Output $$(\underline R,\underline S)$$ as signature (where $$\underline S$$ is the $$b$$-bit little-endian encoding of $$S$$).

My question is: why does it use of $$2b$$-bit hash function? What will happen if we use of $$b$$-bit hash function in the above equations? The $$r$$ in 1 has $$2b$$-bit, but it computes the $$R=rB$$ in 2 and $$S$$ in 3 at the $$\ell$$ module. Note that $$\ell$$ has $$b$$-bit. Why don't we use the hash function with $$b$$-bit output? Is there any security problem with this?

• Did you check the size of the group? In ECC $R = [ r\bmod \text{order of the group}]B$ so greater has no effect. If you see $b$, then you reduce the security to half bits. May 9 '21 at 11:59

Why does EdDSA use of $$2b$$-bit hash function?
It insures $$r\bmod\ell$$ is almost uniformly distributed in $$\{0,1,\ldots\ell-1\}$$. That's explained at the end of the section on Pseudorandom generation of $$r$$, which also explains $$H$$ of $$b+61$$-bit would be enough for this purpose.
Update: I know no I'm told there's is actually a purely cryptographic attack if we reduce $$H$$ to $$b$$-bit. It
Turns out that a less-than-uniform modulo $$\ell$$ not only invalidate the security argument, it allows an attack! It also (and more badly) affects ECDSA, and there was precedents as explained earlier in the section on Pseudorandom generation of $$r$$ of Bernstein's paper.