Security of E2 against Truncated Differential Cryptanalysis