Vulnerabilities in specifying the hash algorithm used for signature verification on a per-message basis Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a hash algorithm is susceptible to collisions, then it doesn't matter how large my RSA key is, and signatures can be forged.

So what is to prevent someone from forging a signature by selecting MD5 as the hash algorithm used to "sign" a message?
To forge a message using a hash collision, you need to generate a signature (using that hash function to sign a "good" message); then that signature is also a valid signature for the "bad" message.

So, to prevent this from being a concern, you just never sign a message using MD5 as your hash function.  Yes, the attacker can generate a "good" and a "bad" message with the same MD5 hash, but unless he can convince you to sign the "good" message using MD5, that doesn't help him.  If you always use SHA-512 when you sign messages, that means that the attacker must find a collision in the SHA-512 hash function; we believe that's infeasible.