KubeCon + CloudNativeCon India 2026

SBOM regulations (NTIA, EU CRA,CISA) create conflicting requirements: auditors demand transparency while vendors require confidentiality. We present a two-layer Merkle commitment architecture separating public change detection from private component disclosure. Layer 1 builds standard Merkle trees producing public roots for tamper detection—anyone monitors changes without seeing components. Layer 2 commits internal hashes with 256-bit random nonces, yielding private commitment roots shared only with auditors for cryptographic hiding. Selective disclosure reveals only changed components via decommitment tuples with O(log n) proofs. Auditors verify commitments reconstruct to trusted roots. Re-randomization refreshes nonces without altering data. Tested: 100 auditors, 100K components, 50K proofs, zero false accepts. Performance: 2.6M disclosures/second, 0.01ms proof generation, 625-byte paths. Policy-based filtering achieves 72% disclosure reduction.