Say Alice has the following set: $\{A_1,A_2,\ldots,An\}$
and Bob has the following set: $\{B_1,B_2,\ldots,B_m\}$
Alice creates a key $a$ and bob creates a key $b$
these keys should be commutative (eg: use RSA)
Alice encrypts each element of her set with $a$ to create $\{A_{1'},A_{2'}, \ldots,A_{n'}\}$
and similarly Bob makes $\{B_{1'},B_{2'},\ldots,B_{m'}\}$ with $b$
Alice sends her set to Bob and Bob sends his to Alice.
Alice encrypts each element of $\{B_{1'},B_{2'},\ldots,B_{m'}\}$ with a to make $\{B_{1"},B_{2"},\ldots,B_{m"}\}$ and similarly Bob makes $\{A_{1"},A_{2"},\ldots,A_{n"}\}$
Now Alice sends $\{B_{1"},B_{2"},\ldots,B_{m"}\}$ to Bob and Bob sends $\{A_{1"},A_{2"},\ldots,A_{n"}\}$ to Alice.
Because the keys commute, if $Bi=Aj$ for some $i$ and $j$, then $Bi" = Aj"$
Thus Alice and Bob can each identify which elements they have in common.
Also this protocol only requires encrypting and communicating each element twice so it has $O(n+m)$ run time.
I have not been able to find this protocol anywhere and it seems very simple so I thought there must be a problem with it.