Thank you for the questions @enrico.eth and apologies for the slow response.
We haven’t yet decided on the encryption scheme the protocol will use for this. Ultimately the notes will need to be consumed by the contract which emitted them and to spend them their existence in the note hash tree will need to be proven.
Does that answer your question or was there other information that you were after?
Yes, you are correct. A Merkle membership proof of the note hash tree is required and would potentially leak some degree of privacy if Bob requests this from a public full node.
We consider this a separate but closely related issue and are looking at ways of protecting Bob’s privacy for these requests.