diff --git a/zkey/keystore.c b/zkey/keystore.c
index 957ebb00..2f161b22 100644
--- a/zkey/keystore.c
+++ b/zkey/keystore.c
@@ -77,6 +77,7 @@ struct key_filenames {
 #define REC_SEC_KEY_SIZE	"Secure key size"
 #define REC_CLR_KEY_SIZE	"Clear key size"
 #define REC_XTS			"XTS type key"
+#define REC_KEY_TYPE		"Key type"
 #define REC_VOLUMES		"Volumes"
 #define REC_APQNS		"APQNs"
 #define REC_KEY_FILE		"Key file name"
@@ -2140,6 +2141,7 @@ static struct util_rec *_keystore_setup_record(bool validation)
 	util_rec_def(rec, REC_CLR_KEY_SIZE, UTIL_REC_ALIGN_LEFT, 20,
 		     REC_CLR_KEY_SIZE);
 	util_rec_def(rec, REC_XTS, UTIL_REC_ALIGN_LEFT, 3, REC_XTS);
+	util_rec_def(rec, REC_KEY_TYPE, UTIL_REC_ALIGN_LEFT, 54, REC_KEY_TYPE);
 	if (validation)
 		util_rec_def(rec, REC_MASTERKEY, UTIL_REC_ALIGN_LEFT, 54,
 			     REC_MASTERKEY);
@@ -2178,6 +2180,7 @@ static void _keystore_print_record(struct util_rec *rec,
 	char *description;
 	char *volume_type;
 	char *reencipher;
+	char *key_type;
 	char *creation;
 	char *volumes;
 	char *change;
@@ -2212,6 +2215,7 @@ static void _keystore_print_record(struct util_rec *rec,
 	reencipher = properties_get(properties, PROP_NAME_REENC_TIME);
 	vp = properties_get(properties, PROP_NAME_KEY_VP);
 	volume_type = _keystore_get_volume_type(properties);
+	key_type = properties_get(properties, PROP_NAME_KEY_TYPE);
 
 	util_rec_set(rec, REC_KEY, name);
 	if (validation)
@@ -2226,6 +2230,7 @@ static void _keystore_print_record(struct util_rec *rec,
 		util_rec_set(rec, REC_CLR_KEY_SIZE, "(unknown)");
 	util_rec_set(rec, REC_XTS,
 		     IS_XTS(secure_key_size) ? "Yes" : "No");
+	util_rec_set(rec, REC_KEY_TYPE, key_type);
 	if (validation) {
 		if (valid)
 			util_rec_set(rec, REC_MASTERKEY,
@@ -2290,6 +2295,8 @@ static void _keystore_print_record(struct util_rec *rec,
 		free(vp);
 	if (volume_type != NULL)
 		free(volume_type);
+	if (key_type != NULL)
+		free(key_type);
 }
 
 struct validate_info {
diff --git a/zkey/pkey.c b/zkey/pkey.c
index 8471f3d0..c07b9c4a 100644
--- a/zkey/pkey.c
+++ b/zkey/pkey.c
@@ -790,3 +790,42 @@ int get_master_key_verification_pattern(const u8 *secure_key,
 
 	return 0;
 }
+
+/**
+ * Check if the specified key is a CCA AESDATA key token.
+ *
+ * @param[in] key           the secure key token
+ * @param[in] key_size      the size of the secure key
+ *
+ * @returns true if the key is an CCA AESDATA token type
+ */
+bool is_cca_aes_data_key(const u8 *key, size_t key_size)
+{
+	struct tokenheader *hdr = (struct tokenheader *)key;
+
+	if (key == NULL || key_size < SECURE_KEY_SIZE)
+		return false;
+
+	if (hdr->type != TOKEN_TYPE_CCA_INTERNAL)
+		return false;
+	if (hdr->version != TOKEN_VERSION_AESDATA)
+		return false;
+
+	return true;
+}
+
+/**
+ * Returns the type of the key
+ *
+ * @param[in] key           the secure key token
+ * @param[in] key_size      the size of the secure key
+ *
+ * @returns a static string on success, NULL in case of an error
+ */
+const char *get_key_type(const u8 *key, size_t key_size)
+{
+	if (is_cca_aes_data_key(key, key_size))
+		return KEY_TYPE_CCA_AESDATA;
+
+	return NULL;
+}
diff --git a/zkey/pkey.h b/zkey/pkey.h
index c0aac2e8..029dc983 100644
--- a/zkey/pkey.h
+++ b/zkey/pkey.h
@@ -18,6 +18,18 @@
 /*
  * Definitions for the /dev/pkey kernel module interface
  */
+struct tokenheader {
+	u8  type;
+	u8  res0[3];
+	u8  version;
+	u8  res1[3];
+} __packed;
+
+#define TOKEN_TYPE_NON_CCA	0x00
+#define TOKEN_TYPE_CCA_INTERNAL	0x01
+
+#define TOKEN_VERSION_AESDATA	0x04
+
 struct secaeskeytoken {
 	u8  type;     /* 0x01 for internal key token */
 	u8  res0[3];
@@ -82,6 +94,8 @@ struct pkey_verifykey {
 
 #define PKEY_VERIFYKEY _IOWR(PKEY_IOCTL_MAGIC, 0x07, struct pkey_verifykey)
 
+#define KEY_TYPE_CCA_AESDATA        "CCA-AESDATA"
+
 #define PAES_BLOCK_SIZE             16
 #define ENC_ZERO_LEN                (2 * PAES_BLOCK_SIZE)
 #define VERIFICATION_PATTERN_LEN    (2 * ENC_ZERO_LEN + 1)
@@ -116,4 +130,7 @@ int get_master_key_verification_pattern(const u8 *secure_key,
 					size_t secure_key_size, u64 *mkvp,
 					bool verbose);
 
+bool is_cca_aes_data_key(const u8 *key, size_t key_size);
+const char *get_key_type(const u8 *key, size_t key_size);
+
 #endif
diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c
index c683fd40..293b8efd 100644
--- a/zkey/zkey-cryptsetup.c
+++ b/zkey/zkey-cryptsetup.c
@@ -1999,6 +1999,8 @@ static int command_validate(void)
 	printf("  Secure key size:       %lu bytes\n", keysize);
 	printf("  XTS type key:          %s\n",
 	       keysize > SECURE_KEY_SIZE ? "Yes" : "No");
+	printf("  Key type:              %s\n",
+	       get_key_type((u8 *)key, keysize));
 	if (is_valid) {
 		printf("  Clear key size:        %lu bits\n", clear_keysize);
 		printf("  Enciphered with:       %s CCA master key (MKVP: "
diff --git a/zkey/zkey.c b/zkey/zkey.c
index a0dbc0b5..0c8321fa 100644
--- a/zkey/zkey.c
+++ b/zkey/zkey.c
@@ -1416,6 +1416,8 @@ static int command_validate_file(void)
 	printf("Validation of secure key in file '%s':\n", g.pos_arg);
 	printf("  Status:                Valid\n");
 	printf("  Secure key size:       %lu bytes\n", secure_key_size);
+	printf("  Key type:              %s\n",
+	       get_key_type(secure_key, secure_key_size));
 	printf("  Clear key size:        %lu bits\n", clear_key_size);
 	printf("  XTS type key:          %s\n",
 	       secure_key_size > SECURE_KEY_SIZE ? "Yes" : "No");