`known_hosts` has nothing to do with public key authentication. It's a list of servers you've previously connected to and fingerprints of their SSH keys to help verify the connection to the server is not being man-in-the-middled. `authorized_keys` is a file stored on the server containing the SSH public keys of users authorized to log in to the server. `id_rsa` is the private key. `id_rsa.pub` is the public key. The public key is encoded according to the format in [RFC 4253](https://tools.ietf.org/html/rfc4253#section-6.6), but basically it's a PEM-encoded blob that contains the key type, length, and the values `n` and `e`. Public key authentication does not involve passwords at all. There's no "password confirmation" step at all. When the client connect, it offers the keys it has to server. If the server can use one of those to connect, it asks the client to sign metadata about the request, including data provided by both the client and server. The client takes the request data, signs it with the *private* key, and then sends it back to the server. The server verifies the signature of the blob, which shows that the client possess the correct private key (matching one of the public keys in `authorized_keys`) and grants access.