PRF'(K,S) = T1 | T2 | T3 | T4 | ...

   where:
   T1 = HMAC-SHA-256 (K, S | 0x01)
   T2 = HMAC-SHA-256 (K, T1 | S | 0x02)
   T3 = HMAC-SHA-256 (K, T2 | S | 0x03)
   T4 = HMAC-SHA-256 (K, T3 | S | 0x04)
   ...