CBC-MAC key can be added to ciphertext? I use AES both CBC and CBC-MAC to encrypt some stuff. I generate one key for CBC and one different key for CBC-MAC.


Does the second key (for CBC-MAC) need to be secret?
How to join such key with the ciphertext? By contatenating it at the end?
From the sound of your questions, it almost appears that you have some confusion between the CBC-MAC key and the CBC-MAC tag.

The CBC-MAC algorithm takes the message (in this case, most likely the ciphertext) and a secret key; it outputs a tag (which can be public).  The security property of CBC-MAC is that someone who does not know the key cannot generate a valid message, tag pair, even if he sees a huge number of valid message, tag pairs (of course, he is not allowed to suggest a message, tag pair that he has been given).  Actually, it works even if he is allowed to specify the messages.

The idea is that if the receiver (Bob) gets a message and tag pair that validates, that means that the sender (Alice) must have generated it.  After all, only someone who knows the key is able to generate such a pair, and the only two are Alice and Bob (and Bob knows he'll never generate such a pair, so Alice must have sent it).

With that in mind, your questions:


  Does the second key (for CBC-MAC) need to be secret?


Absolutely; if the attacker is given that key, then all security bets are off.  He can easily generate a valid MAC tag for any message he picks.


  How to join such key with the ciphertext? By concatenating it at the end?


No, you don't send out the key with the ciphertext; it needs to be secret.  On the other hand, you can send the tag with the ciphertext; concatenating the tag at the end is one common approach.