Is there a variant of Merkle tree with no traceability from root to leaves? I'd like to store a large amount of objects, all authenticated using something like a Merkle tree. The root will be published, and I'd like to make sure there is no way to enumerate these objects from the root of the tree, or even prove a document is in the tree, unless this information has been published by me.

Is there an existing variant of Merkle tree to do so, or should I invent something myself? I came up with the following scheme, but it is most probably utterly broken:


A root is a hash(first-level nodes + salt).
Every node is a hash(next-level nodes/documents + salt).
A separate salt is stored for every document and for every node
In order to reveal a document I publish the path in the tree with all the salts along the way.
Merkel trees already allow you to decide how much you reveal. To prove presence of one leaf, you reveal it and the commits along its copath.

If your documents contain enough entropy then you do not need salts. If the documents do not, then you may prepend each document with a salt I.e. $\text{hmac}(\text{secret} \| \text{index}, \text{message})$.

The intermediate nodes do not need salts.

To avoid leaking the number of documents you can fix the copaths length to $\lceil\log_b(N)\rceil$. This adds an additional $N - b^{\lceil\log_b(N)\rceil}$ zero-sized documents as additional noise. $b$ is the number of branches per depth (usually $2$). The padding should be uniformly shuffled with all documents, not ordered or appended to the end. The $\text{index}$ identifier is the position from root-to-leaf left-to-right after flattening the tree. I.e. $[0], [1, 2], [3, 4, 5, 6]$.