I'm thinking up a scheme where a merkle tree is used to ensure integrity of a set of data items, and different parties are allowed to verify the integrity of different subsets of that data.
Let's assume a process where an operator measures a physical property of items that pass his workstation on a conveyor belt. Let's, for example, define the following properties that are collected for each measurement event.
operator id timestamp item id parameters measurements workstation id
For reasons of data integrity and traceability the measuring device computes a signature over all the properties whenever it produces a measurement.
Now let's assume a hash of all these properties and the signature are to be stored publicly (for example on the Blockchain). Anyone with access to all properties can verify the publicly stored hash and signature. But what if we have multiple stakeholders interested in the integrity of different subsets of those properties, what if we want to let people verify a subset of the properties without disclosing others.
If we create a merkle tree of all these properties we could disclose the value of some properties (leaves in the tree) and only root hashes of some subtrees, allowing people to calculate the root hash and verify the signature.
But there is still a concern of confidentiality. For example, the same operator id will always hash to the same value. So what if a salt was introduced into the operator id subtree. I.e. the operator id subtree-hash would be
H(operator id | salt) where
| denotes concatenation. Thus, if we with to disclose the operator id, we disclose the operator id and the salt. If we do not wish to disclose the operator id, we only disclose the root hash of the subtree.
Let's assume the length of all properties and salts is fixed, or is prepended to the item in question.
If the hash function is cryptographically secure, noone should be able to come up with a different operator-id-salt combination that produces the same hash.
From the perspective of some verifiers, they only learn one or two properties, and a large number of random-looking subtree root hashes. Maybe some subtree root hashes don't belong to actual subtrees, but are just random data. Is there a scenario where this could be a problem for verifiers.
Is this a terrible idea?
(I'm aware that there is also concern of a length extension attack, depending on the hash function used, where someone could append another subtree on the right side and calculate a valid root hash).