Simple forward deniability is easy to achieve with PGP: simply don't sign the email you send ! Anybody can send emails with arbitrary contents and alleged sender; signatures are meant specifically to cancel forward deniability.
However, if you do not sign you also lose integrity. What you would like is to be able to send an email such that:
- the recipient can be reasonably sure that the email is from who he believes the sender to be, and has not been altered in transit;
- but neither external attackers or the recipient themselves gain any proof that could be shown to third parties that the alleged sender really sent the email.
Connected protocols like instant messaging can achieve these properties by using a shared secret established with a protocol like Diffie-Hellman. When Alice and Bob share the secret K (and used authentication to establish that shared knowledge), and Bob receives a message with a correct MAC value which uses K, then Bob knows that the message comes from Alice, because only Alice and himself know K, and Bob did not send it himself. However, Bob has nothing "convincing" to show, because since he knows K, he could have forged all the messages.
With emails, there is no connection, so no semi-transient shared secret: a secret value that sender and recipient share, never stored in a file but still retained for several successive messages. However, there is a kind of "encryption-with-MAC" format in OpenPGP, section 5.13. The format is also very flexible, so one could build an OpenPGP message containing:
- a public-key encrypted session key packet which contains a random K encrypted with the recipient's public key;
- a signature packet which includes a signature computed over the previous packet (and only over that packet, not the plaintext data);
- the plaintext data, as an "encryption-with-MAC" packet.
Such an email would incarnate forward deniability with integrity: from the outside, it can be proven that the alleged sender sent at least one message, one day, to the recipient; and the recipient can show K and the proof tells that K was known to the sender too. However, nobody can demonstrate that any specific message contents were encrypted with K.
Unfortunately, though the OpenPGP format can support a lot of combinations, this is not necessarily the case of existing implementations (like GnuPG). Moreover, the "encryption-with-MAC" packet uses a cheap homemade MAC (it simply appends the SHA-1 hash of the data, and encrypts the whole lot) which does not look very secure to me. I am not aware of extensive studies of that sort-of-MAC construction, but I would not bet my last shirt on its robustness.
So you can potentially have forward deniability with authentication and integrity in PGP but only as long as the relevant software support this specific combination, which, as far as I know, they do not. Yet.
In cryptographic research, there is also another type of algorithm called ring signatures would could be applied to the subject: with ring signatures, the sender (Alice) computes a special type of signature involving her private key and the public key of the recipient (Bob), such that it can be proven, from the outside, that either Alice or Bob computed the signature, but which one actually did it is unknown.
There is no currently defined support for ring signatures in OpenPGP.