One technical gripe: you forgot that the arithmetic needs to be modular to guarantee anonymity. Let's just say the large random number is chosen between 0 and 9,999,999. (You need a range because there's no such thing as a "random uniform" integer.) Now let's say that Person 1's salary is 100,000 and that large random number is 9,999,935. Now Person 2 gets handed 10,099,935 and knows that Person 1 makes at least $99,936, because the "large random number" couldn't have been any higher than 9,999,999. If modular arithmetic is used, with the modulus being the upper bound on the "large random number", then nothing like this is ever given away. Person 2 gets handed 99,935... which could be 9,999,935 + 100,000, or 4,935 + 95,000, or 9,099,935 + 1,000,000, or 99,934 + 1. (Of course, the modulus needs to be big enough that there's no doubt that it's going to be larger than the sum of the salaries.)