A method for secure cryptographic keys generation in the presence of untrusted units in a cryptographic system, the system comprising a first and a second cryptographic stations (A,B), where each cryptographic station comprises n raw data generation units, KGU A i, KGU B i with i=1, 2,..., n, where n>1, being at least one of these raw data generation units untrusted, and at least one post-processing unit CLPU A CLPU B, where the method comprises the following steps: - Each pair of raw data generation units, KGU A i and KGU B i, with i=1, 2,..., n, generating a pair of data strings which are correlated to each other and sending the generated data string by KGU A i to the at least one post-processing unit of the first cryptographic station and sending the generated data string by KGU B i to the at least one post-processing unit of the second cryptographic station; - The at least one post-processing units of the first and second cryptographic station, CLPU A, CLPU B: - applying a post-processing procedure to each received data string for generating a cryptographic key, K A i, K B i or an error symbol for each raw data generation unit, where the post-processing procedure includes at least one information reconciliation operation between the post-processing units of both cryptographic stations via an authenticated communication channel and a first privacy amplification procedure to extract a shorter key; - concatenating the generated cryptographic keys to form a first concatenated cryptographic key K A '=[K A 1, K A 2,..., K A M] and a second concatenated cryptographic key K B '=[K B 1, K B 2,..., K B M] where M is the number of pairs of generated cryptographic keys in both cryptographic stations which are different from the error symbol; - applying an additional privacy amplification procedure operation to the first concatenated cryptographic key and to the second concatenated cryptographic key to extract a first and a second secure cryptographic keys respectively, K A and K B. - Each pair of raw data generation units, KGU A i and KGU B i, with i=1, 2,..., n, generating a pair of data strings which are correlated to each other and sending the generated data string by KGU A i to the at least one post-processing unit of the first cryptographic station and sending the generated data string by KGU B i to the at least one post-processing unit of the second cryptographic station; - The at least one post-processing units of the first and second cryptographic station, CLPU A, CLPU B: - applying a post-processing procedure to each received data string for generating a cryptographic key, K A i, K B i or an error symbol for each raw data generation unit, where the post-processing procedure includes at least one information reconciliation operation between the post-processing units of both cryptographic stations via an authenticated communication channel and a first privacy amplification procedure to extract a shorter key; - concatenating the generated cryptographic keys to form a first concatenated cryptographic key K A '=[K A 1, K A 2,..., K A M] and a second concatenated cryptographic key K B '=[K B 1, K B 2,..., K B M] where M is the number of pairs of generated cryptographic keys in both cryptographic stations which are different from the error symbol; - applying an additional privacy amplification procedure operation to the first concatenated cryptographic key and to the second concatenated cryptographic key to extract a first and a second secure cryptographic keys respectively, K A and K B. - applying a post-processing procedure to each received data string for generating a cryptographic key, K A i, K B i or an error symbol for each raw data generation unit, where the post-processing procedure includes at least one information reconciliation operation between the post-processing units of both cryptographic stations via an authenticated communication channel and a first privacy amplification procedure to extract a shorter key; - concatenating the generated cryptographic keys to form a first concatenated cryptographic key K A '=[K A 1, K A 2,..., K A M] and a second concatenated cryptographic key K B '=[K B 1, K B 2,..., K B M] where M is the number of pairs of generated cryptographic keys in both cryptographic stations which are different from the error symbol; - applying an additional privacy amplification procedure operation to the first concatenated cryptographic key and to the second concatenated cryptographic key to extract a first and a second secure cryptographic keys respectively, K A and K B.