HID Global pivCLASS readers work with the pivCLASS Authentication Module (PAM) to perform the following two-factor authentication checks: PIV + PIN - after the cardholder enters his PIN into the pivCLASS reader's keypad, the pivCLASS reader works with the pivCLASS Authentication Module to enable a "match-on-card" check of the PIN. A PIN match unlocks the card's PIV authentication key certificate so it can be read from the card. The PAM then performs cryptographic tests to ensure the card's validity. This includes a signature check of the PIV certificate and a private key challenge to ensure the public key in the PIV authentication certificate is bound to the private key on the card. This category of pivCLASS readers secures against cards that have been counterfeit, altered, copied, cloned, lost or stolen.