I'm using TPM 2.0 to do a remote attestation for a computer. In order to do that you have to generate a signing key from a primary key. This generate a public key and an encrypted private key. As per the official documentation it says "Preservation of the returned data is the responsibility of the caller". So I'm wondering what the best thing to do from a security perspective ? store the private part in NVRAM ? and if I store both on disk, what are the scenarios that the key will be compromised ? And computing power necessary (for brute force for example) thanks
The private key that you store was encrypted by the TPM itself before it left the TPM, and can be decrypted only using the TPM's primary key (which only exists inside the TPM). The encrypted key you have is useless without the TPM, it cannot be compromised without access to the TPM. You can store it however you want.
Note that if you're keeping the key away from someone who has access to the TPM (can execute code/commands on the computer that communicate with the TPM, has access to the primary), this is another question and has nothing to do with TPM.
You do need to make sure you don't lose it, because the TPM cannot recreate it - you have the only copy. So multiple copies and backups might be a good idea.
The key should be RSA 2048 (or 3072 or 4096) or ECDSA NIST P-256. Unless your TPM has the ROCA vulnerability (or something like it), it is impossible to brute force on a classical computer using all the money in the world. Note: not "expensive" but "impossible". On hardware we can understand, breaking those keys will require some breathtaking new math, not brute force.
If in the future a large quantum computer will be built, it will be able to brute force the key, but first the owners of this marvelous device will go after higher profile targets and you will hear about it on TV. Nobody knows when such a device will be built, and there is scientific debate whether it will ever get built.